时间:2024-09-20 09:03:47 来源:网络整理编辑:知識
Next time you make a payment on Venmo, beware: almost anyone can track it.The popular mobile payment
Next time you make a payment on Venmo, beware: almost anyone can track it.
The popular mobile payments app is sharing users' personal data — including real names, comments sent with the payment, transaction dates, and recipients of the transaction — with the public by default. This information is being exposed through company’s public API, and it can be hidden by adjusting your privacy settings from "Public" to "Private."
Security researcher Hang Do Thi Duc recently discovered this "alarming amount" of information being leaked by examining the public API. The reason its happening, the researcher suggests, is because the Venmo app's default settings are set to "Public" for all users.
Using transaction data made available through the public API, Do Thi Duc downloaded 207,984,218 Venmo transactions, all the public transaction made on the app in 2017, and analyzed them. She has detailed her findings in an aptly named project called Public By Default.
SEE ALSO:Venmo fare-splitting is coming to the Uber appTo show just how much detail you can pull from the public Venmo transaction data, Do Thi Duc’s Public By Default project focuses on on five specific Venmo accounts. The five accounts, whose identities she’s chosen to keep private, include a Cannabis seller in California, a food truck vendor, a married man and woman, a junk food lover, and a fighting couple.
The amount of information Do Thi Duc is able to pull from the transaction data Venmo is sharing is pretty astonishing. For example, she was able to track the food truck vendor’s number one customer and find exactly when she’d go and what she was buying to eat. In the case of the married couple, Do Thi Duc was able to not only tell where they shop but also who was responsible for what bill.
In her report, Do Thi Duc was able to obtain even more information about the people behind these public transactions based on the profile picture they were using. If a Venmo user chose to link up their Facebook account so they can use the same profile picture as their Venmo avatar, Venmo’s public API shares the Facebook picture URL along with the rest of the transaction. This profile picture URL includes a user’s Facebook ID, which in turn will direct you straight to a person Facebook profile.
The fact that Venmo has enabled such easy access to this type of information in the form of a public API is problematic. In the hands of the right – or wrong – person this info is ripe for identity theft. Not only that, but the access to this information by say a stalker or domestic abuser is potentially dangerous.
In a statement, Venmo is quick to point out that while the “safety and privacy of Venmo users and their information is one of our highest priorities,” when it comes to protecting this information, it’s up to each Venmo user to change their default Venmo settings and make it private.
We recommend you do just that.
TopicsCybersecurityPrivacy
Felix the cat just raised £5000 for charity because she's the hero we all need2024-09-20 08:42
皇馬撬姆巴佩?巴黎反挖戰艦左閘 砸7100萬解約金2024-09-20 08:41
搜狐體育獨家連線記者王曉瑞:國足為了整個行業該換帥2024-09-20 08:37
亞泰上海集訓迎來小長假 14日重新集結備戰中超爭冠組較量2024-09-20 08:27
Slack goes down again, prompting anxiety everywhere2024-09-20 07:52
南美區積分榜:阿根廷無憂 智利烏拉圭反向操作2024-09-20 07:40
媒體人質問李鐵 :阿蘭洛國富這種表現 之前為什麽不好好用?2024-09-20 07:38
哭了!看球油價已超英超季票價格 球迷生活不易2024-09-20 07:17
This German startup wants to be your bank (without being a bank)2024-09-20 07:15
C羅隱身!5射1正禁區內僅有6次觸球 評分倒數第三2024-09-20 07:12
Tyler, the Creator helped Frank Ocean celebrate 'Blonde' release in a delicious way2024-09-20 08:19
官方 :圖赫爾當選英超10月最佳主帥 單月四戰全勝2024-09-20 08:04
國足VS阿曼數據:多項落入下風 控球率44.7%2024-09-20 07:31
意大利VS瑞士前瞻:世預賽生死戰 藍衫軍需英雄出現2024-09-20 07:29
Samsung Galaxy Note7 teardown reveals the magic behind the phone's iris scanner2024-09-20 07:24
意大利VS瑞士前瞻 :世預賽生死戰 藍衫軍需英雄出現2024-09-20 07:16
曝博格巴主動要求與曼聯續約 但要求薪水高於C羅2024-09-20 07:13
意大利VS瑞士前瞻:世預賽生死戰 藍衫軍需英雄出現2024-09-20 06:54
Man stumbles upon his phone background in real life2024-09-20 06:39
國足戰阿曼首發進行恢複性訓練 朱辰傑詳解如何助攻武磊破門2024-09-20 06:23