Hot new trading site leaked oodles of user data, including login tokens

guest · Jan 10, 2019

Hot new trading site leaked oodles of user data, including login tokens
January 9, 2019
https://arstechnica.com/information...d-oodles-of-user-data-including-login-tokens/

The past few days have showered plenty of favorable attention on a new trading platform called DX.Exchange, with glowing profiles by Bloomberg News and CNBC. The only problem is that the site, which allows people to trade currencies and digitized versions of Apple, Tesla, and other stocks, has been leaking oodles of account login credentials and personal user information.
Super easy to criminalize
Almost immediately, the trader identified a major problem. When his browser sent DX.Exchange a request, it included an extremely long string of characters, called an authentication token, which is supposed to be a secret the site requires when a user accesses her account.

“I have about 100 collected tokens over 30 minutes,” said the trader, who asked not to be identified because he’s concerned the site might take legal action against him. “If you wanted to criminalize this, it would be super easy.”
But wait… it gets worse
[...] the leak puts the entire security of the site in serious jeopardy because some of the leaked tokens appear to belong to employees of the site.
Click to expand...

Rasheed187 · Jan 10, 2019

You gotta be kidding me. This stuff really makes me wonder just how secure web based services are. Think of email, and online banking.

Log in or Sign up

Hot new trading site leaked oodles of user data, including login tokens

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Hot new trading site leaked oodles of user data, including login tokens

guest Guest

Rasheed187 Registered Member

Useful Searches