Hacker News Reader

ryanseyson From 0 to Skype in 9 Months

And restrict access to this page (which lists all the keys, salted or otherwise)... https://twelephone-voicemail.s3.amazonaws.com/

ryanseyson From 0 to Skype in 9 Months

I think this is unacceptable because this is easily brute-forceable, especially when you (by default) tweet the other user that a voicemail has been left.

https://twitter.com/ryanseys/status/355009243306405890

EDIT: Also, the timestamp is per-second (1rajmadugulaedwardallison12013-04-23T17:06:49Z.wav) not per millisecond, making bruteforce a rather elementary task when combined with twitter tweet information.

ryanseyson From 0 to Skype in 9 Months

Their voicemails seem to be public...

Just pick a key from https://twelephone-voicemail.s3.amazonaws.com

and voila!

https://twelephone-voicemail.s3.amazonaws.com/1rajmadugulaed...