Hello, I put one foot in front of the other.
But stuff still happened.
So what's up?
Polyamory is all the rage these days.
But what if your data was polyamorous?
Dating at field is trying to be something different.
They want to give you more options to like dial in exactly what you're looking for.
And they also exposed all of your information to everybody, like all of them.
Like every like it's like, whoa, I want to preface this by saying
that Field now claims they have already solved all of these problems.
But let's talk about what happened.
Internet security firm Fortbridge did a test of field services
and alerted Field that, hey, dog, anyone can basically do anything
without even needing to hack your account.
These are the things that they were able to do just by poking and prodding.
They were able to view photos that they weren't supposed to be able to see.
They could read, edit and delete other people's messages.
They could send messages in other users' chats.
They could edit other people's profiles
and they could also view other people's matches.
And that's not the exhaustive list.
So how do they do this?
Do they hack into the mainframe?
Did they like steal the CEO's thumbprint to get past biometric security?
No, they just kind of looked at the data.
Buckle up, boyos.
We're going to get nerdy with it.
It's time for an education.
When an app interfaces with a server, it uses a thing called an API.
Basically, Field's API was hella fucked.
The researchers looked at the data that was being sent to their app
and found that their app was loading data that they weren't supposed to have access to
for the purposes of showing them that they don't have access to the data.
Like, here's a person's picture.
They're blurred.
You're supposed to have to, like, match with them or subscribe or whatever
before you can actually see the photo,
but they sent the photo to your phone and then blurred it on your phone
so you actually have that data.
Now, the average user isn't going to just randomly stumble upon this,
but a bad actor wouldn't have to do a whole lot to get that information.
But what's worse is they started then pushing back on the API,
saying, hey, API, I swear I'm this other user.
What can you do for me?
And the API was like, oh, baby, oh, baby, I do it all.
So, yeah, they were able to pretend that they were the app and say, hey, server,
I'm that person.
Let me edit their profile.
And the server was like, yeah, sure, that makes sense to me.
Yeah, you absolutely are them.
Consider this metaphor.
You walk into a doctor's office and walk straight to the front desk
and say, I'm John Wanmin.
I want my medical records.
And they're like, OK, John Wanmin, here you go.
Here's your medical records.
And then without breaking eye contact, you're like, I'm Lisa, Lisa Min.
Also, give me my medical records.
And they're like, absolutely, Lisa, Lisa Min, here you go.
Here's your medical records.
You're like, OK, cool.
Neat.
Field was alerted of these vulnerabilities back in March,
and they didn't fully tackle all of them until August, apparently.
The blog post came out just last week.
So, hey, it's really easy to hear stories like this and be like, oh, well,
it's the internet.
My data's everywhere.
It's not worth even bothering.
I really encourage you to push back on that sentiment.
General privacy, personal security, it's an ongoing battle,
but it's not a lost cause on the internet.
It's hard, but it's possible.
And while in this case, it was literally a matter of people trusting
a third party entity that didn't properly implement security protocols
that are basic, still, you can do some simple stuff like use a password manager.
I highly recommend Bitwarden as a password manager
if you're looking for a place to start, not sponsored.
Lightning round.
Boeing workers have gone on strike.
They might be on strike for quite some time because Boeing was like,
hey, we're going to give you that raise that you wanted.
It is garbage.
And the workers voted almost unanimously to go on strike.
So they're, they're holding out.
USPS is rolling out new delivery trucks and they are adorable.
Stubby little dudes.
An update on a story from a while back, an NYPD cop who learned
that the department had these like get out of jail free cards that were kind of
hush hush and passed out to friends and family.
He pushed back on that and got reprimanded for it.
But just recently he ended up winning a big old settlement out of the deal.
Notably, the NYPD has no intention to stop using these cards.
In fact, Eric Adams, former head cop and now mayor of New York City,
acknowledged the settlement but didn't say anything else.
He declined to comment.
And finally for today, the entire team of Anapurna Interactive,
a video game publishing company that published Stray and Outer Wilds.
Quit.
They are a subsidiary of Anapurna just in general.
There's also Anapurna Pictures,
but they wanted to spin off into their own company and the Anapurna was like, no.
So they were like, all right, bye.
That's all I have for you today.
Thank you so much for joining me.
Head to SKH.News for sources and more.
My name is Endeavorance.
I will see you again soon.
Take care and be well.