Hacker News Reader

Comment by krab | Hacker News Reader

Nice find!

There's a problematic but not critical personal information leak, a mild business intelligence leak and that's about it.

> They could keep this script running for months, even years, creating awkward scenes and uncomfortable conversations at every restaurant across the country.

If that's about the worst thing you can actively do, then it's only about the data leak.

View on HN

"Why were you at X when you told me you were at Y? And why did you order for 2 people? Why have you been going there for the last Z months?"

"By following the pattern of when you were there and what you ordered, I found the other person's details too"

In the EU the leak of the mobile number alone would be sufficient for this to count as a serious breach

No, that's the most inconvenience you can cause. There are worse things you can do: target specific people with spurious orders, cancel everything they order, or if you want add random items to every order, making the entire system useless.

people are underestimating the havoc this could create in a country like India. Imagine serving chicken at a table that is strictly vegetarian (many people in India are vegetarian due to religious reasons), will lead to a lot of outrage.

This could even be lethal if you are ordering something you know the target is allergic to...

Aren't phone numbers being leaked if you iterate over the tables?

Yeah, that's the PII leak.

Reply on news.ycombinator.com