Post #3134786
2024-01-18 21:31 UTC
@WPalant@infosec.exchange @thisismissem@hachyderm.io Just connecting to the db won't show you what data is in it to determine it's not just your data. So he must have dumped it or at the least queried it sufficiently deeply to make that call.
Replies (1)
-
@Profpatsch@mastodon.xyz 2024-01-19 09:23
@tklengyel@discuss.systems @WPalant@infosec.exchange @thisismissem@hachyderm.io Just connect to it with a GUI tool like dbeaver (like devs are likely to do), it will show you the schema of tables. There will be columns like “clientName” or similar, and then doing a few very simple selects will tell you whether you have access to other people’s data.