Pentru cine nu cunoaste, Kickstarter este o platforma de crowdfunding. Ai o idee geniala pentru un gadget sau app dar nu ai bani pentru a o implementa? Incarci proiectul impreuna cu o prezentare frumoasa si astepti ca oamenii sa il finanteze, primind in schimbul banilor acel produs.
Fiindca Kickstarter nu ofera o solutie completa pentru gestionarea intregii campanii, au aparut solutii third-party care fac acest lucru. Una din ele este Pledgebox.
Problema apare atunci cand ai nevoie sa transferi datele campaniei (de la descrierea campaniei, toate reward-urile pana la lista cu toti oamenii care au sustinut acel proiect). Pentru a face acest transfer Pledgebox are nevoie de adresa de e-mail si parola contului creator de pe Kickstarter.
Pledgebox, fara vreun motiv clar, a ales sa ofere aceste date de logare tuturor. Practic, toti creatorii de campanii de pe Kickstarter dar si de pe Indiegogo (platforma similara de crowdfunding) care au folosit Pledgebox au datele de login vizibile oricui viziteaza Pledgebox.com si arunca un ochi mai bine pe acolo.
Nu inteleg de ce face asta dar consecintele sunt extrem de grave fiindca este vorba de datele personale ale tuturor oamenilor care participa la acele campanii.
Solutiile ar trebui sa vina din partea tuturor partilor implicate. Pledgebox sa nu mai ofere aceste informatii, Kickstarter sa adauge autentificarea in doi pasi ca standard pentru toate conturile si sa implementeze un API bazat pe token-uri limitate la anumite adrese IP. Astfel poti trage datele in siguranta, fara a mai avea nevoie de un mail si o parola.
EN:
For anyone who doesn’t know, Kickstarter is a crowdfunding platform. Got an idea for a gadget or a app but don’t have the money to make it? Load the project, put a nice description and wait for the people to fund it, in exchange giving them that product.
Because Kickstarter doesn’t offer a complete solution for managing the campaign, a lot of third-party website now help you manage it. One of them is Pledgebox.
The problem is when you need to transfer all of the Kickstarter campaign into Pledgebox (campaign description, reward tiers, list of all the people who funded the project). To do this, Pledgebox needs the e-mail address and password for the creator account on Kickstarter.
Pledgebox, without any reason, chose to offer the data to anyone. Basically, all campaign creators from Kickstarter or Indiegogo (a similar crowdfunding platform) who used Pledgebox have their login data visible to anyone who visits Pledgebox.com and takes a closer look.
I don’t know why you’d do this but the consequences are serious because it involves personal data of all backers.
To solve this, both parties need to change things. Pledgebox should stop offering emails and passwords to anyone, Kickstarter shoud add 2FA by default to any account and should create an API based on tokens valid only for specific IP addresses. This way you can pull data without needing an e-mail and password.
