Comment on Authy got hacked, and 33 million user phone numbers were stolen
0xD@infosec.pub 6 months agoWell from a professional here: It is.
Comment on Authy got hacked, and 33 million user phone numbers were stolen
0xD@infosec.pub 6 months agoWell from a professional here: It is.
NateNate60@lemmy.world 6 months ago
I’m not talking out of my arse here either. I don’t work in security specifically but I’ve got a CS degree as well and it contradicts my understanding of how those terms are generally used. This is an open API endpoint, equivalent to leaving the garage door open.
But the distinction is usually unimportant. A security hole is a security hole regardless of what you call it.
lando55@lemmy.world 6 months ago
To build on you analogy: if you left your garage door open and people came in and started taking your things, is that not stealing?
NateNate60@lemmy.world 6 months ago
Of course it’s stealing. But they didn’t break in.
Hacking = breaking in
Data breach = stealing stuff
lando55@lemmy.world 6 months ago
What about this scenario:
Would this be considered breaking in? Probably. Here is where the analogy breaks down; if I were to leave the front door of my house unlocked, even if there’s a welcome mat outside, anyone who enters without my knowledge or consent can be charged with breaking and entering (yes, even though no actual breaking is involved).
The interesting thing with public APIs is that there are generally terms and conditions associated with creating an account and acquiring a key, though if you are hitting an unauthenticated endpoint you technically never agreed to them. In this particular case with Authy, it would probably be argued that the intent was to acquire data by exploiting a vulnerability in the custodian’s system and use it for nefarious purposes or profit. I’d call it a hack.