upvote

points

by logotype4 hours ago |
comments
upvoteby jacquesm4 hours ago|
[-]
Bullshit. That's not for the 'whitehat' to determine.

"We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)"

You can't know that without pulling the data.

reply
upvoteby liquid_thyme3 hours ago|
parent|
next
[-]
Why do you insist on other people following your personal preferences?
reply
upvoteby jacquesm3 hours ago|
parent|
next
[-]
The law is - contrary to your opinion - not a personal preference.

POC -> fine

Actual mass exfiltration -> not fine.

reply
upvoteby james_marks44 minutes ago|
parent|
next
[-]
I think you missed that they only pulled the first page of paginated results. The opposite of exfiltration.
reply
upvoteby jacquesm41 minutes ago|
parent|
[-]
Of 10K+ tables...
reply
upvoteby liquid_thyme3 hours ago|
parent|
prev|
[-]
So you're a legal expert now too? You characterization of what happened as "mass exfiltration" is just that - your personal opinion.
reply
upvoteby jacquesm3 hours ago|
parent|
[-]
No, OP documents that in painful detail.

https://gdpr-info.eu/art-4-gdpr/ section 12.

Under the GDPR this was a breach, pure and simple.

reply
upvoteby buzer2 hours ago|
parent|
next
[-]
It's personal data breach for the controller (Lovable or the company that manages the app. Probably latter unless they are determined to joint controllers). It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).

One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.

reply
upvoteby jacquesm2 hours ago|
parent|
[-]
> It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).

Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.

The GDPR does not have a 'legitimate interest' category that includes exploiting breaches. White hat hackers are neither processors nor controllers and can never claim legitimate interest in the data.

reply
upvoteby liquid_thyme3 hours ago|
parent|
prev|
[-]
"pure and simple" is again - YOUR interpretation. Sorry, but this is genuinely not interesting anymore. But thanks anyway for engaging. Good luck.
reply
upvoteby 3 hours ago|
parent|
prev|
[-]
deleted
reply
upvoteby neathack3 hours ago|
parent|
prev|
next
[-]
I mentioned this in another comment, but for completeness: we didn’t actually pull all the data. The number would likely look much worse if we had.
reply
upvoteby jacquesm2 hours ago|
parent|
[-]
> I mentioned this in another comment, but for completeness: we didn’t actually pull all the data. The number would likely look much worse if we had.

Indeed, it would look a lot worse if you had.

reply
upvoteby slopinthebag3 hours ago|
parent|
prev|
[-]
wtf is your problem?
reply
upvoteby cprsimpson2 hours ago|
parent|
[-]
He's an AI maximalist who frequently posts in AI related threads. He's being very hostile because the OP's work is a threat to his agenda.
reply
upvoteby The_Blade2 hours ago|
parent|
next
[-]
thank you for doing that work for me, i just assumed this fella has such an agenda

my second guess was meth, third strict Constitution AIst

reply
upvoteby jacquesm2 hours ago|
parent|
[-]
Well, then that assumption would be completely wrong.

This is beyond silly.

reply
upvoteby jacquesm2 hours ago|
parent|
prev|
next
[-]
Oh, that's hilarious. You made an account just to post this gem anonymously?
reply
upvoteby cprsimpson2 hours ago|
parent|
[-]
Yes, your behavior in this thread was bad enough to inspire me to create an account to comment on it.
reply
upvoteby 16 minutes ago|
parent|
prev|
[-]
deleted
reply