Using Lyft share link you can pull all names of users

https://news.ycombinator.com/item?id=7105409
by mauerbac • 13 years ago
5 1 13 years ago

It seems through Lyft's new share link you can pull the names of all the users. Ex: https://www.lyft.com/invited/MATT2398. Decrementing the last four digits exposes other users. You can try this with other names. Not sure if this is a vulnerability since it's just names. Surprised they didn't hash them.

Related Stories

Loading related stories...

Source preview

news.ycombinator.com