points by wackget 4 days ago | 0 comments
That sounds all sorts of illegal, and all sorts of immoral.
Did you flag it / create an issue?
[–] primitivesuave 4 days ago
[–] lelandfe 4 days ago
> some variation of "why are you sending secrets in query parameters in the first place?" (I'm not)
The example from the blogpost: `http://localhost:4000/patient/{(SECRET}}`
Wherein the logger logs the final URL with the secret.
I think I agree with the masses? It strikes me as an odd place to put a secret.
But to your credit, they also... shouldn't be logging endpoints? Secrets or no. That's basically what this person said responding to your post: https://medium.com/@fsufitch/if-you-are-writing-this-off-as-...
> Postman is, in essence, "looking over your shoulder" and jotting down all URLs you query
My main point was that I wouldn't want my secrets to ever be sent to Postman under any circumstance (or alternately, stop calling them "secret"). A lot of the online responses were some variation of "why are you sending secrets in query parameters in the first place?" (I'm not). When I posted on Reddit, it escalated to targeted harassment by people who were obviously current/former employees at Postman.
I did send out an email blast to a bunch of CIOs/CSOs in my network which went a bit "email viral" through forwarding, and this ended up triggering a substantial amount of enterprise cancellations.