I remove the default upvote on my own comments because I'm a weirdo
Zarobi
joined 2 months ago
Well they are an orange cat…
Yes, it was the person who posted the image lol (you can check votes using a tool if you're ever curious)
the API endpoint GET
[redacted]will return user data for any account - not just your own account - so long as you supply a valid, five-digit user ID. It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else's data,” she wrote.This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site. “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained. “One GET request per user. for i in range(1, 719518): scrape(). That's it. That's the exploit.”
My God, that's horrific. Plus it doesn't even delete your data if you delete your account, it's still vulnerable.
Buddha would never say that dude what the fuck. Meet me behind the maccas
Can I join the cool kids list too?
🥺👉👈
Yeah it could just be \d*
I remove my own default upvote from my comments because I'm a weirdo
They do, but you can't say "this isn't medical advice" and then turn around and give medical advice. Especially to the point of discouraging seeing a doctor.
It didn't used to. There was the whole "memories" thing that it kept between conversations. I hated it
They probably meant 6 digit and it was a typo. The rest of the article references 6 digits. If it's just an integer (highly likely) it would go up to 10 digits or roughly 2 billion max users. My old coworkers and I used to joke that hitting
INTEGER.MAX_VALUEfor your customer ID is a good problem to have