robotrobot

Talis, Birmingham, UK.

EdTech 100% employee owned, SaaS software already in use in 50% of UK Universities, plus growing Oz, NZ, Malaysia, China and Norway.

Post-revenue and pre-profit (not for long). Every position comes with equity share via options scheme.

Various roles including dev, microservices architecture Node.JS, Java, AngularJS

Check out our ethos: http://careers.talis.com/

Hmm. Another one for your security audit. I was able to change the registered email address on our account

1) Without re-entering my creds following login 2) With no notification to the old email address that this had been done.

Thanks (can't reply direct to the reply for some reason)

Me again.

"he was only able to reach less than 1% (our estimate is 5,000 users)"

So you have 500k registered customers then? Surely not.

OK, I want to make sure though. How can these creds be regenerated? What happens if we had leaked them accidentally, there seems no way to regen them?

Another thing to mention here - we've received no direct contact from BS at all following this - if we hadn't been following this on HN (and we were a little naive) we might still not know this email was not genuine. The blog post mortem is great, but I think it's a poor show not to reach out to affected customers directly.

Is anyone from BrowserStack monitoring this thread? We received the email so we can assume our account was accessed by the hacker. Passwords crypted and salted (ok - changed) but what about the BrowserStack automate username and token, generated by BS themselves, that we are unable to edit or regen?

We've been doing this for a while in our angular apps using response interceptors: http://engineering.talis.com/articles/elegant-api-auth-angul...

This guy is crazy if he thinks an organisation with annual /revenues/ of $110M will spend $10M+ on a domain name.

I think those numbers are years.... :)

Try hitting reload - I managed to get in after a few attempts