Hacker News new | ask | show | jobs
by laurent123456 2958 days ago
Yet they silently blocked his website from using this API thus acknowledging it's actually an issue.
3 comments

Shoot the messenger. SOP.

Maybe someone should tip off Google project Zero about this? Let's see if they mean it that they will hold themselves to the same standard.

Looks like they took it down for everyone [0]; maybe not the most elegant approach but at least it seems they're taking it more serious now.

[0]: https://stackoverflow.com/questions/50289065/google-yolo-sto...

It would be very interesting to see a split second exact timeline on this.
Indeed. A Google engineer stated on Twitter [0] that the shutdown of the service happened because apparently YOLO is only supposed to be accessible to whitelisted partners.

[0]: https://twitter.com/sirdarckcat/status/994867632355577862

So, whitelisted partners get the ability to rip your data?

I'm sure that will go down just fine. FB just got into a lot of trouble over something like that (arguably a lot more serious, but still).

They also state in the same Twitter thread that they were aware of the issue before the blog post was written. IANAL but even if the shutdown was intentional (as opposed to being the example of terrible damage control it looks like), willfully leaving a bug in production that allows a set of whitelisted partners to deanonymize their visitors without their consent seems like something that shouldn't fly in countries with data protection laws?
Sounds like a fix.

By the terms of the VRP it sounds like the reporter is owed a payout.

Bounty deserved, yes. Fixed? No, they only blocked his address, anyone else can still grab your info on their sites.
Looks like it's blocked for everyone now
It's blocked for people who aren't on the whitelist.
That is interesting, do you have more info? I'd imagine the whitelist being quite enormous!
I don't have any information besides what I've seen posted the comments here. For example this: https://twitter.com/sirdarckcat/status/994867632355577862
Exactly. If it was about "just whitelisted partners" he discovered it was actually "everybody." It's not different than discovering that instead of the password just an empty string is enough.
Well, that did protect users from his site, at least :)