Wish list app from Target springs a major personal data leak
http://arstechnica.com/security/2015/12/wish-list-app-from-target-springs-a-major-personal-data-leak/
To our surprise, we discovered that the Target app's Application
Program Interface (API) is easily accessible over the Internet.
An API is a set of conditions where if you ask a question it
sends the answer. Also, the Target API does not require any
authentication. The only thing you need in order to parse all of
the data automatically is to figure out how the user ID is
generated. Once you have that figured out, all the data is
served to you on a silver platter in a JSON file.
- - -
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
I have consulted to Google, but I am not currently doing so.
My opinions expressed here are mine alone.
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
