this post was submitted on 05 Jul 2024
736 points (99.2% liked)

Technology

60086 readers
5161 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] NateNate60 1 points 5 months ago (1 children)

I'm not talking out of my arse here either. I don't work in security specifically but I've got a CS degree as well and it contradicts my understanding of how those terms are generally used. This is an open API endpoint, equivalent to leaving the garage door open.

But the distinction is usually unimportant. A security hole is a security hole regardless of what you call it.

[–] lando55 1 points 5 months ago (1 children)

To build on you analogy: if you left your garage door open and people came in and started taking your things, is that not stealing?

[–] NateNate60 1 points 5 months ago (1 children)

Of course it's stealing. But they didn't break in.

Hacking = breaking in

Data breach = stealing stuff

[–] lando55 1 points 5 months ago (1 children)

What about this scenario:

  • you keep your main garage door, side doors, and windows locked
  • provide a key to anyone who wants to borrow your lawnmower or whatever
  • someone discovers a window you mistakenly left unlocked and starts using it to take stuff without using a key

Would this be considered breaking in? Probably. Here is where the analogy breaks down; if I were to leave the front door of my house unlocked, even if there's a welcome mat outside, anyone who enters without my knowledge or consent can be charged with breaking and entering (yes, even though no actual breaking is involved).

The interesting thing with public APIs is that there are generally terms and conditions associated with creating an account and acquiring a key, though if you are hitting an unauthenticated endpoint you technically never agreed to them. In this particular case with Authy, it would probably be argued that the intent was to acquire data by exploiting a vulnerability in the custodian's system and use it for nefarious purposes or profit. I'd call it a hack.

[–] NateNate60 1 points 5 months ago

The scenario you described would not be breaking in.

Terms and conditions being agreed to are not relevant for this purpose. An exposed API is one that is welcome to be exploited. If you're not requiring an API key, you're essentially saying "This API is free for anyone to use" for security purposes, regardless of what you say in the terms and conditions.