Hacker News Reader

Comment by whalesalad | Hacker News Reader

Totally not the same thing. Not even close. Knowing a tracking number is nothing compared to having access to someone's AWS account. That's like saying knowing where someone's car is parked is the same as having their keys and a full tank of gas.

I agree with silhouette. These guys scaffolded a rails project and and then slapped bootstrap on it. You can't trust an MVP this extreme.

View on HN

This is exactly the same thing - an obvious security oversight that resulted in private information being disclosed, simply by modifying the URL.

The fact that the results are so different is irrelevant - the attack vector was essentially the same.

Also, even with the complete lack of security on this site, it should still not be possible to take any action on the victim's AWS account. IAM has read-only roles for this exact reason - hopefully no-one was negligent enough to post their master AWS key/secret in to this or any other third-party site.

The results absolutely do matter. If you're running a site, you should be auditing the areas where the security risk is the greatest and taking extra precautions, and those areas are hopefully few. If you're not first taking care of the places where the results are disastrous, then you're doing it wrong.

Obviously if there is a known attack vector, you would fix any similar issues everywhere, but not all code is the same.

The point I was making is that this particular flaw is indeed the same as the UPS flaw when considered at a high level - modifying a URL caused sensitive data to be disclosed.

In practical terms, of course the nature of data that is disclosed is relevant. AWS keys are incredibly valuable, and should be treated as such.

Wait, does rails scaffolding turn off security by default?

Reply on news.ycombinator.com