←back to thread

I hacked a dating app (and how not to treat a security researcher)

(alexschapiro.com)
560 points bearsyankees | 2 comments | 12 May 25 16:39 UTC | HN request time: 0.42s | source
Show context
camcil ◴[12 May 25 17:14 UTC] No.43965309[source]▶
In a data conscious world, the complete and utter disregard for PII and lack of competency in design and implementation would result in catastrophic business failure.

They may have "patched" the ability to exploit it in this way, but the plaintext data is still there in that same fragile architecture and still being handled by the same org that made all of these same fundamental mistakes in the first place. Yikes.

replies(1): >>43966157 #
hiatus ◴[12 May 25 18:33 UTC] No.43966157[source]▶
> In a data conscious world, the complete and utter disregard for PII and lack of competency in design and implementation would result in catastrophic business failure.

As you are probably well aware, we do not live in that world. Companies like Equifax can suffer breaches exposing the personal information of millions and stock still goes up.

replies(3): >>43966215 #>>43966219 #>>43966353 #
1. CobrastanJorji ◴[12 May 25 18:40 UTC] No.43966219[source]▶
Sorry about that. Please fill out this class action postcard, and, if approved, you will receive up to two years of identity protection services provided by Equifax (to be served concurrently with any other court-ordered two years of identity protection services), or, if you have financial damages you can conclusively prove are directly linked to this specific identity disclosure, you may mail your evidence to the provided address for up to $1000 in restitution, pending arbitration.
replies(1): >>43966342 #
2. nickpeterson ◴[12 May 25 18:53 UTC] No.43966342[source]▶
Maybe they’ll send you duplicate $1000 checks if you claim to be the other people in the leak.