Huge Security Concern with Tsu (New Social Network 7MM Investment)
4 comments
Register https://www.tsu.co/Beeriscure
Anyway if you need an invite to try it out: http://www.tsu.co/jsanto
Thanks for the heads up, it can't be something that big (at least based on funding) dedicates such poor attention to security... it's really a bit weird.
Don't act like this isn't your startup: https://news.ycombinator.com/item?id=8499841
EDIT: May have been premature, but it is still suspicious.
EDIT: May have been premature, but it is still suspicious.
What're you talking about?
http://www.sfgate.com/entertainment/article/Upstart-social-n...
^ Sebastian Sobczak is the founder, you're an idiot if you think I'd be posting security issues with my own startup.
Educate yourself.
http://www.sfgate.com/entertainment/article/Upstart-social-n...
^ Sebastian Sobczak is the founder, you're an idiot if you think I'd be posting security issues with my own startup.
Educate yourself.
Don't act like you are burning in ENVY.
It's not my startup and I'm not even remotely connected to it (like the pun?). I just submitted a link about it. Chill.
It's not my startup and I'm not even remotely connected to it (like the pun?). I just submitted a link about it. Chill.
I can assure you he has no relation to Tsu.
You're welcome. That's what happens when rookies develop MVPs.
I'm not sure a rookie could build a social network platform together with a distributed revenue system on top of it, without having ever been exposed to what SSL is, because that'd be the only excuse for not implementing it, unless they are really doing this to make people talk about them.
Just to update looks like they took my concerns into consideration.
Anyway here's the fun part...
So I decided to try it out, feel free to register using the "invite link" below (it's invite only right now), just don't use a password you use for anything else... http://tsu.co/dragmecom
Here's why...
Take a look when you're registering, notice how there's no SSL? Haha you guessed it, all of their information throughout the entire site is completely unencrypted. That means all passwords, emails, user addresses, etc. are unencrypted and visible to anyone and everyone.
You don't need to be a security expert to know this, it's almost text book knowledge for anyone who has ever interfaced with the web on a technical level. Soooooo my fellow hacker news friends, enjoy this new found information.
Maybe one of you might be so encouraged to post, "I love good security" via the founder's account. I tried to email the staff about the concern but still haven't received a response, maybe you all can "encourage" them to expedite patching this crucial security concern, and protect their users.
Happy cracking! :)