Hacker News Reader

Comment by lamontcg | Hacker News Reader

I have no idea why you'd expect to have the right to probe around APIs like this and not be accused of malicious hacking.

You don't have authorization, you're working for a competitor, that business decided to throw you to the wolves because its easy for everyone involved to forget you ever said anything since you didn't leave any paper trail.

If I find you sneaking around in my backyard having managed to open a ground floor window I'm going to probably lose my shit and call the cops, and not thank you for discovering a security flaw.

You need to get permission for this kind of shit, and not go around jiggling other people's locks.

And the level of effort here seems fairly high and a lot more than just "view source".

The author probably deserves to lose the ability to be employed at a bank because this was some pretty bad judgment.

View on HN

Lol the audacity to say any of this. The only mistake this dude was trying to be nice to either of the two shit companies he worked for. A fintech created a shitty shitty app and released it to the public and you accuse this guy of “jiggling” the lock ? He should have totally released this info on 4chan and let the wolves do their job.

Unpacking a competitor app and poking around private APIs to reverse engineer implementation is a liability landmine. Ask your company’s lawyer.

Finding and disclosing a security flaw isn’t even needed for this to be a problem. You’re immediately a liability to your company. You’re breaking TOS or whatever agreement the competitor app install or usage has. You’re opening up your employer to an espionage or IP theft lawsuit.

There are many easy ways to do compete analysis that don’t involve these liabilities.

> You don't have authorization

Yes, you do. Authorization and Authentication are part of the API. If you want to keep a server private, don't give it a public IP and DNS!

Exactly! When you throw your data on the street, don't suppose that no one will read it.

If you don't lock your doors, it doesn't give anyone else the right to come into your house.

A business can be sitting unoccupied with its doors flung wide open, and that is still tresspassing if you enter without authorization.

"You were too dumb to stop me, so its my right to rifle through your shit" is a nerd law that doesn't exist in the real world.

Don't do this kind of jiggling of door handles without authorization, if you don't want to wind up like OP.

Ask a real lawyer for advice.

They'll almost certainly tell you not to do it.

This is less like sneaking around your back yard, and more like going in the front door of a business and looking around, and then finding a bunch of credit card numbers sitting around on the desk behind the counter.

Based on the text of the post, it seems like OP stopped "probing the API" as soon as they had enough information to know that there was a security hole. So is your proposal that any kind of probing of APIs in general should be considered malicious? Like if someone has an image conversion API and I submit a gif, or a 1x1 image to see what happens, that makes me a malicious hacker?

That position seems wrong to me, and the strained physical-world analogies you give don't justify it. Often, testing something directly is the only way to find out how it actually works. Which is necessary in plenty of non-hacking situations.

Maybe you don't understand what happened here. It's not your lock where he jiggles. He just found out that your bank that states that she secures your money with a good lock in a safed room stores your money on a big pile on the yard without a fence.

Reply on news.ycombinator.com