From 0 to Skype in 9 Months | Hacker News Reader

From 0 to Skype in 9 Months

bloggeek.me

55 pointscmatthieu23 comments

Their voicemails seem to be public...

Just pick a key from https://twelephone-voicemail.s3.amazonaws.com

and voila!

https://twelephone-voicemail.s3.amazonaws.com/1rajmadugulaed...

You would need to know the exact millisecond of the timestamp and usernames to access it. Our plans are to allow sharing of video/voice messages publicly if the user chooses. Feedback welcome...

I think this is unacceptable because this is easily brute-forceable, especially when you (by default) tweet the other user that a voicemail has been left.

https://twitter.com/ryanseys/status/355009243306405890

EDIT: Also, the timestamp is per-second (1rajmadugulaedwardallison12013-04-23T17:06:49Z.wav) not per millisecond, making bruteforce a rather elementary task when combined with twitter tweet information.

Good point. Salting the key should make this better.

And restrict access to this page (which lists all the keys, salted or otherwise)... https://twelephone-voicemail.s3.amazonaws.com/

Oh my, why isn't this page restricted? That is a very serious flaw in the system.

Not exactly caring about the users' privacy, or security.

We haven't yet officially released voice messaging but the feature stuck into this release. We'll correct the access on our next update (prior to it being announced). Thanks everyone.

This is a issue where you pull the plug right now, fix the issue and tell your users about. Otherwise your company just dug its own grave publicity-wise. Privacy is the foremost important issue if you handle people's communication.

We're working on the update now...

17 hrs since that was reported and the directory is still public.... You should probably work faster, at this time it is safe to assume that all voicemails have been downloaded...

You have to wait for an "update" before you can take that page down?

Yea, the answer reminds me to the security issue with the Zamfoo cpanel plugin, when the developer promised to fix it in the next update but for some other reasons he couldn't release the update for weeks: http://www.webhostingtalk.com/showthread.php?t=1275572 https://news.ycombinator.com/item?id=5888036

One message may or may not be someone waiting for about 30s for the "beep" to tell them to start their message. Lol.

[I have poor impulse control, sorry.]

As ryanseys points out, a timestamp and username doesn't provide any kind of security.

Since this uses Twitter, a good move may be to use Twitter's API to check if the correct user has been logged in (I don't know the Twitter API).

Would using direct messages work?

What do you mean? I just picked random Key values from that and could download those files with no problem. This is a crazy privacy issue!

It's totally understandable to make a mistake like this and it's early, but it's scary how you think that's an acceptable solution.

To be clear, I just went to that first URL, copy and pasted the key to the end of the URL, and I listened to you leaving a message saying "This is a test. 1,2,3".

I did not need to know anything else. This is not good.

Wouldn't it be better to share this directly with the service provider instead of exposing users' data like this? Also kinder?

I'm interested in the Twitter permissions required.

* Read Tweets from your timeline. * See who you follow, and follow new people. * Update your profile. * Post Tweets for you.

Does Twelephone only require posting tweets and following new people for completing positive actions by the user or is this like FB apps that spam your feed? Could those permissions be added as needed; I'm assuming that you don't need to follow new users or tweet anything for me to direct connect a Twelephone session with a current friend??

It seems incongruous you tout privacy features as a bonus (http://twelephone.com/#learnmore) but that to use the service Twelephone gets access to everything one does on twitter.

Perhaps these are just standard permissions that twitter hands out with user authorisation?

I believe that these are standard Twitter permissions. Twelephone only needs tweet permissions. We're not using any other Twitter APIs (other than OAuth).

Phono seems to support any browser, why does this only support Chrome and Firefox?

Only Chrome and FireFox support WebRTC video. We are working on adding Phono voice support for Safari, IE, and Opera using Phono's Flash and Java Applet capabilities.

how exactly WebRTC going to solve raised questions regarding privacy ? in light of a fact that, for ICE to operate, you need STUN server and exchange ICE candidates (and SRTP keys) through WebRTC server

Reply on news.ycombinator.com