Comment on Authy got hacked, and 33 million user phone numbers were stolen
NateNate60@lemmy.world 4 months agoWith due respect, you are wrong.
hack
…
- (transitive, slang, computing) To hack into; to gain unauthorized access to (a computer system, e.g., a website, or network) by manipulating code
Hacking means gaining unauthorized access to a computer system by manipulating or exploiting its code.
just_another_person@lemmy.world 4 months ago
Exactly what this is. Read the disclosure. What about your response doesn’t fit that?
NateNate60@lemmy.world 4 months ago
They did not do it by manipulating code. This wasn’t the result of a code vulnerability. If you leave the door wide open with all your stuff out for the entire neighbourhood to see, you can’t claim you were “broken into”. Similarly, if you don’t secure your endpoints, you can’t claim you were “hacked”.
sudneo@lemm.ee 4 months ago
Lack of rate limiting is a code vulnerability if we are talking about an API endpoint.
Not that discussion makes any sense at all…
Also, “not securing” doesn’t mean much. Security is not a boolean. They probably have some controls, but they still have a gap in the lack of rate limiting.
NateNate60@lemmy.world 4 months ago
It is a vulnerability, but exploiting that vulnerability is not generally considered by security experts to be “hacking” in the usual meaning of that term in academic settings. Using an open or exposed API, even one with a sign that says “don’t abuse me”, is generally not considered hacking.
just_another_person@lemmy.world 4 months ago
Image
NateNate60@lemmy.world 4 months ago
Please provide a link to whatever source claims this.
I hold a computer science degree and this contradicts the definition of “hack” versus “exploit” used in academic settings.