• pivot_root@lemmy.world
    link
    fedilink
    English
    arrow-up
    71
    ·
    4 days ago

    Tea was storing its users’ sensitive information on Firebase, a Google-owned backend cloud storage and computing service.

    Every time. With startups, it’s always an unsecured Firebase or S3 bucket.

    • NeilBrü@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      edit-2
      4 days ago

      I’m certainly no web security expert, but shouldn’t Tea’s junior network/backend/security developers, let alone seniors, know how to secure said Firebase or S3 buckets with STARTTLS or SSL certificates? Shouldn’t a company like this have some sort of compliance department?

      • zqps@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        9
        ·
        edit-2
        4 days ago

        It’s a little more complex than that. If you want the app on the user device to be able to dump data directly into your online database, you have to give it access in some way. Encrypting the transmission doesn’t do much if every app installation contains access credentials that can be extracted or sniffed.

        Obviously there are ways around this too, but it’s not just “use TLS”.

        • NeilBrü@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          edit-2
          3 days ago

          Encrypting the transmission doesn’t do much if every app installation contains access credentials that can be extracted or sniffed.

          Encrypt the credentials then? Or OAUTH pipeline, perhaps? Automated temporary private key generation for each upload (that sounds unrealistic, to be fair)? Can credentialing be used for intermediary storage that encrypts the data on that server and then decrypted on the database host?

          Clearly my utter “noobishness” is showing, but at least it’s triggering a slight urge to casually peruse modern WebSec production workflows. I am a DNN researcher. Thus, I am far removed from customer-facing production environments, and it shows.

          Any recommendations on literature or articles on how engineers solve these problems in a “best practices” way that you can recommend? I suppose I could just look it up, but I thought I’d ask.

          Edit: I don’t know why I’m down-voted. My questions were sincere.

    • Kalothar@lemmy.ca
      link
      fedilink
      English
      arrow-up
      3
      ·
      3 days ago

      My hey we’re probably using Firestore as their database without authenticating their api calls to firebase functions. Basically leaving their api endpoints open to the public Internet.

      They could have connected service account and used some kind of auth handshake between that and generate a temporary login token based on user credentials and the service account oauth credentials to access the api. but they probably just had everything set to unauthenticated