Hacker News Reader

Hacker News

Comment by jtokoph | Hacker News Reader

Parent Full thread

jtokoph

It looks like someone just scraped all of the public profiles.

View on HN

It looks more like a SQL dump to me. The data doesn't seems to be too critical however.

How so? It is exactly the data you see when you open any clubhouse profile in the app

Almost as if there was an endpoint /profiles/id that someone just scrapped by using id 0..9999999999

One of the first places I worked they had that.

For private data.

Guess their user id and you could get someones whole contact list, access their voicemail, or start a 30 person conference call which could dial out internationally with calls billed to the affected user...

The entire top management had user ids below 100...

I found the problem because on login all it set was a cookie with the userid, and so of course I tried changing it.

When I alerted my manager to the problem they put in place 'encryption' of said cookie.

It was base64 encoding.

They were shocked when I broke that too.

Writing this now it sounds invented, but it's not. To be fair this was more than 20 years ago, and a lot of developers did not yet have any understanding of security, so they at least had a shred of an excuse.

I left that company first chance I got.

> 'encryption' of said cookie...It was base64 encoding.

Made me chuckle.

I never figured out what thought process led to them considering base64 a security feature. I mean, I could tell just by looking at the cookie it was base64, but I expected that meant they'd encrypted it and then base64 encoded the result. But no. It made me treat every bit of code I was handed with extreme caution.

If I were collecting a large amount of data, I would most likely store it in a database.

Active data yes, archived data goes into the warehouse.

Yup, this seems to be the case. I don’t know how this could be characterize as a leak?

It's definitely a grey area here. Clubhouse strongly encourages using real names on their platform. That can be considered personal information that should be protected by security controls that they seem to lack, based on what others have mentioned here, that could have limited this "leak".

Reply on news.ycombinator.com