Aggregator

Petrol prices are soaring and wallets everywhere are feeling the pinch. Is it time to rethink how we get around?

Apple Business combines corporate device management offerings and a way to buy ads

Apple has simplified its business services by combining and rebranding them, and is giving away the reformulated enterprise offering for free.…

A few holiday seasons ago, Paul S was doing the requisite holiday shopping online, looking for those perfectly impersonal but mildly thoughtful gifts that many companies specialize in. This was one of the larger such vendors, well known for its fruit-filled gift baskets. As is not uncommon for our readers, when the site started misbehaving, he pulled up the dev tools. He didn't solve the problem, but he did learn a lot about how they were managing their API keys, as this was exposed to the client:

env: { APP_AUTH0_GUID: 'ctZZL1BqgKm9kBmDEKAjt0yBeQ47Cpwl XS0xxpLFS5g8o-EUpSu4fi9ecOqN19WnXn-EqI9yaupwme22bKuBd2jH3Kf3QngZ', APP_LOGGING_ENABLED: 'true', APP_LOGGING_SERVICE_PATH: 'r/api/logging/mbp-ui', REACT_APP_MBP_LOGGER_CONSOLE: 'ERROR', APP_TIQ_ACCOUNT: '1800flowers', APP_TIQ_PROFILE: 'full', APP_TIQ_ENV: 'prod', APP_PAYPAL_SDK_URL: 'https://www.paypal.com/sdk/js', APP_PAYPAL_CLIENT_ID: 'AcYrxrOkFwUnMKRoJmkOR0N6caopqRNqwNRxy6H-EvZ-IKUz22i-E0uT0uMT7JQZEC33Oy1HCNsgm_le', APP_PAYPAL_ENV: 'production', APP_PAYPAL_SOURCE: 'PWA', APP_VENMO_ENV: 'production', APP_VENMO_PROFILE_ID: '2705494007504552889', APP_AUTH_LOGIN_SOURCE: 'undefined', APP_SG_BASKET_SCRIPT: 'https://cdn2.smartgiftit.com/scripts/widgets/gift-basket.js', APP_AUTH_DOMAIN: 'login.celebrations.com', APP_AUTH_AUDIENCE: 'celebrations-prod.1800-flowers.auth0.com', APP_STATUS_BAR_ENABLED: 'true', APP_WALLET_ENABLED: 'true', APP_VERIFY_ADDRESS_HOST: 'api.edq.com', APP_VERIFY_ADDRESS_AUTH_TOKEN: '47d991c9-043e-4073-bee3-a5c8922baa3a', APP_FULLSTORY_ORG_ID: 'MXD30', APP_GRAPHQL_ENV: 'production', APP_VISA_CHECKOUT_API_KEY: 'B0LQRDVCE0LWKBHR880J14gCRlEjr_UqLhh6V-yYRAmcvD0W8' }

I've gone ahead and mangled the keys, and given that this was a few holidays ago, I'd hope the retailer in question has fixed their website. But as you can see, it was pushing API keys for payment processors, along with potential authentication tokens and internal IDs. Now, I would hope most of these required additional authentication to be useful, and that a malicious actor couldn't do anything nasty with this information- but that's a dim hope. Even with the data exposed here, I wonder if someone could flip APP_PAYPAL_ENV to "development" or "test" and run some transactions through. Or do the same with Venmo.

This is a React app, based on some of the keys, using Graphql for communicating with the back end, and that hits at the fact that it's a single-page application. Probably, the developers were trying to build once for the web and for a "website bundled in an app" deployment for smart phones. And the result is that they weren't thinking about the distinction between "public" and "private" information- they had state to manage,so they managed it. By sending it to the client. Where anyone could see it. But it looked good, they shipped it, and they made sales, so everyone was happy.

For a time.

[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.

I'm A Celebrity bosses are allegedly blaming Janice Dickinson for her own horror fall in the jungle.

Small businesses, councillors and the MP fear the roadworks will be 'extremely disruptive'

The reality TV star posted a photo to her Instagram Stories on Monday, writing that her three-year-old son Sidney has conjunctivitis, also known as pink eye.

Hurrying across snowy fields, trotting down frozen lanes and marching purposefully down the side of a busy motorway in Changchun, the capital of China's north-east Jilin province.

President Donald Trump claimed Tuesday that Iran has given up its nuclear ambitions as he said both Vice President JD Vance and Secretary of State Marco Rubio are leading peace negotiations.

Reports of thefts - with culprits seemingly capable of cracking locker codes - range from high-end watches to deeply sentimental jewellery.

Alexis De Naray, 45, studied at the Prue Leith Cooking School and worked in several high-end kitchens in London, Stafford Crown Court heard.

The rapper sat down for a rare interview with GQ magazine, during which he defended 14-year-old Blue's work ethic.

Prince Mohammed bin Salman is leaning on Donald Trump to continue the war against Iran, according to sources briefed by US officials.

The little camp sits unnoticed, dwarfed by towering glass office blocks and hidden by the thronging crowds of central London.

Donald Trump is seeking a one-month ceasefire with Iran and the administration has submitted a 15-point peace plan to Tehran.

There's items for every occasion

Public satisfaction with the NHS has improved for the first time since the pandemic but still remains at 'catastrophically' low levels.

A 'former foolish student' had pinched Imran Ashraf's sign that hung outside his shop, Exotica Foods in Swansea, more than a decade ago after a raucous night out.

The woman was found in a property north of Birmingham city centre at around 6.15pm on March 18, bleeding heavily from several wounds and barely conscious, a court heard on Tuesday.

Claims its set performance records but looks to be years behind western fare

Alibaba has revealed a new server chip that it says is the most powerful processor ever to use the RISC-V instruction set.…

By that point, he was an established supporting player in movies like Anchorman: The Legend of Ron Burgundy and series like The Dana Carvey Show.