Hacker News Reader

Comment by vvanders | Hacker News Reader

Damn, the amount of user trust they just burned by closing that with "as designed, won't fix" is staggering.

Yeah, I read through the post and (assuming I'm parsing it right) can't figure out why this hasn't caused a massive shitstorm already. Are they actually arguing that it's not a security bug because it's necessary for them to implement a 'one click sign in through Google' feature?

Basically, yes.

That's insane.

Likejacking Facebook likes has been around for 8+ years, leaks a similar amount of information, and there’s no big shitstorm. Not sure what the big difference between YOLO and FB’s like button are?

To me Likejacking is more like harvesting organic likes. And YOLO leaks email address which is PII.

I was wondering whether this is actually the same as like jacking. Is the ‘leak’ in that case the ability for the Facebook page/post owner to be able to then look you up in the list of ‘likes’? If so, I think Facebook privacy settings may allow users to not leak their emails or pictures in this case.

Also, I think it’s more widespread given that ‘Google identity’ covers a large number of Google products, and signing into one signs into all. With Facebook any time I log in nowadays I open incognito, check messages, log out, whereas with Google I generally stay logged in, mostly because I want gmail and my cross device browsing history to work.

Do you get user's email from FB’s like button? (edit typo)

Yet they silently blocked his website from using this API thus acknowledging it's actually an issue.

Well, that did protect users from his site, at least :)

Sounds like a fix.

By the terms of the VRP it sounds like the reporter is owed a payout.

Bounty deserved, yes. Fixed? No, they only blocked his address, anyone else can still grab your info on their sites.

Looks like it's blocked for everyone now

It's blocked for people who aren't on the whitelist.

That is interesting, do you have more info? I'd imagine the whitelist being quite enormous!

I don't have any information besides what I've seen posted the comments here. For example this: https://twitter.com/sirdarckcat/status/994867632355577862

Exactly. If it was about "just whitelisted partners" he discovered it was actually "everybody." It's not different than discovering that instead of the password just an empty string is enough.

Shoot the messenger. SOP.

Maybe someone should tip off Google project Zero about this? Let's see if they mean it that they will hold themselves to the same standard.

Looks like they took it down for everyone [0]; maybe not the most elegant approach but at least it seems they're taking it more serious now.

[0]: https://stackoverflow.com/questions/50289065/google-yolo-sto...

It would be very interesting to see a split second exact timeline on this.

Indeed. A Google engineer stated on Twitter [0] that the shutdown of the service happened because apparently YOLO is only supposed to be accessible to whitelisted partners.

[0]: https://twitter.com/sirdarckcat/status/994867632355577862

So, whitelisted partners get the ability to rip your data?

I'm sure that will go down just fine. FB just got into a lot of trouble over something like that (arguably a lot more serious, but still).

They also state in the same Twitter thread that they were aware of the issue before the blog post was written. IANAL but even if the shutdown was intentional (as opposed to being the example of terrible damage control it looks like), willfully leaving a bug in production that allows a set of whitelisted partners to deanonymize their visitors without their consent seems like something that shouldn't fly in countries with data protection laws?

I just received a message back on Twitter saying that the whitelist wasn't the fix and they are still making more changes.

This is seriously denting my continued belief in Google's security chops. I know they have some of the finest security researchers on the planet but this was handled in a ham-fisted and ineffective way so far.

And best of all: without 'partner' status you won't be able to check if has been fixed.

>This is seriously denting my continued belief in Google's security chops. I know they have some of the finest security researchers on the planet but this was handled in a ham-fisted and ineffective way so far.

This is a great demonstration how a company can have all of the right talent but still manage to become incompetent through poor organizational policies.

Lets hope it doesn't happen again.

Just wait a couple of weeks until GDPR takes effect

It would be fine if they only gave whitelist access to people who could already simply access your data by request. But GDPR would only require that they know who could access, and that the access list be less than "the entire world".

They're burning developers and potential employees trust in the first place. This "we don't know how to fix it ==> not a bug" attitude is what's staggering.

To me it shows a gross indifference to being dishonest even when speaking in an official capacity.

I want to say that I hope this is isolated and not a systemic part of their company culture but at this point I can't help but be cynical after this.

This keeps happening over and over again. I remarked the other day that the most feared words when reporting a serious bug are 'won't fix'. It is super annoying. If the feature can't be made to work safely then drop the feature.

Reply on news.ycombinator.com