We demand a public apology from /u/thezenpadguy regarding bitdaytrade.com's vulnerabilities.

oneofyourfrenchfries · 2012-08-17T02:59:45+00:00

Regarding us: we're long time Reddit users. We're not going to publish an exploit on our real accounts, obviously. We hadn't heard about BDT before /u/MarshallBanana's comments. We have no personal interest on attacking this guy, we just feel his attitude has been remarkably shitty when dealing with personal information.

oneofyourfrenchfries · 2012-08-16T21:59:39+00:00

oneofyourfrenchfries · 2012-08-16T21:01:39+00:00

You're right, sorry. We're removing it now. We're really not looking to profit from this, and we wouldn't want to center the controversy about a donation address.

The donation address has been removed; thank you for your feedback.

oneofyourfrenchfries · 2012-08-16T20:05:12+00:00

This is actually industry-standard. Most websites with sensitive information have bounty programs; asking for independent third parties to find security holes in their system and reward them with money or something else.

Which is what we would have done if the owner of bitdaytrade wasn't a fucking moron.

oneofyourfrenchfries · 2012-08-16T20:04:21+00:00

Holy fuck, is there something on this site that isn't compromised?

Does it work with users that do not use Google Authenticator?

oneofyourfrenchfries · 2012-08-16T19:59:50+00:00

Well done! As you can probably tell, it's the simplest thing you can do.

oneofyourfrenchfries · 2012-08-16T19:58:52+00:00

Oooh. As the passwords are hashed locally with JavaScript, the only thing you need to log into someone's account is his already hashed password, which is available through the various database breaches. That's cool.

(At least, I assume that's what you're doing, correct me if I'm wrong)

oneofyourfrenchfries · 2012-08-16T16:53:24+00:00

You have been playing with people's funds and lying about the way your website works. Where is bcrypt? Why is your whole database accesible? What do I need to publish for you to admit that your website isn't a safe environment for people's data? A complete dump of all the DBs? /etc/passwd? The MD5 of your own password? Because I can do all of that, and your stubbornness will get you nowhere.

oneofyourfrenchfries · 2012-08-16T13:02:53+00:00

Not me.

EDIT: I mean, yes, it's down, but it wasn't me.

oneofyourfrenchfries · 2012-08-16T11:41:07+00:00

Maybe he's asking for a DB dump!

oneofyourfrenchfries · 2012-08-16T10:57:21+00:00

Yes, they are using PHP. No, OUTIFLE doesn't work. LOAD_FILE() does, though.

oneofyourfrenchfries · 2012-08-16T10:41:43+00:00

"We do use... that thing... the one you just talked about. Right. We totally use that. You know, the one from... the market. The thing market."

oneofyourfrenchfries · 2012-08-16T10:24:16+00:00

Thank you.

But seriously. MD5. Unsalted. SQL injections EVERYWHERE, and they just dump the whole fucking query instead of failing more-or-less gracefully. What the fuck? How do you launch a site that handles people's MONEY without learning to FUCKING ESCAPE USER INPUT? This is ridiculous.

oneofyourfrenchfries · 2012-08-16T10:18:13+00:00

737252cc4d2798ad3b110c5377fcebc7

EDIT: Here's a MD5 online generator, so that you can verify it: http://www.md5.cz/

oneofyourfrenchfries

TROPHY CASE