Hacker News Reader

Comment by kjhughes | Hacker News Reader

A developer-level explanation would be helpful here.

Was the mistake in the default Firebase configuration settings, or were common poor choices made by each of the app developers independently?

View on HN

Firebase Database default settings make the entire database world-readable and world-writable by all "authenticated users". But once you have enabled authentication, then that means anyone who signs into your app with a Google account. Restricting users to only access their own data requires understanding and writing "security rules".

It's the most irresponsible default I have seen in practice.

I disagree. I bet if the default was no access, developers would simply enable all access (and not even realize they could restrict access to authenticated users). So the default is likely much safer than what would otherwise happen.

Let's not forget that there is a security/permissions testing feature built right into Firebase. It would literally take 1 minute for a dev to ask and test: hey, can people read each other's data?

developers would simply enable all access (and not even realize they could restrict access to authenticated users). So the default is likely much safer than what would otherwise happen.

That's not what "safer" means. You cannot say that that's what would happen, either.

We are using a system called Kinvey and there it's the same . By default everyone can read everybody's data. You can restrict it but I don't understand why they don't have a restricted model as default.

I'm not sure these cases are even using firebase's user authentication - the article is reporting plaintext username/passwords being stored in the databases.

That is not true. The default access is only to authenticated users.

Reply on news.ycombinator.com