<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
xmlns:wfw="http://wellformedweb.org/CommentAPI/">
<channel>
<title>Techdirt. Stories filed under &quot;url&quot;</title>
<description>Easily digestible tech news...</description>
<link>http://www.techdirt.com/</link>
<language>en-us</language>
<image><title>Techdirt. Stories filed under &quot;url&quot;</title><url>http://www.techdirt.com/images/td-88x31.gif</url><link>http://www.techdirt.com/</link></image>
<item>
<pubDate>Thu, 6 Dec 2007 00:43:27 PST</pubDate>
<title>Canadian Passport Website Falls For Oldest Privacy Breach On The Web</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20071205/190901.shtml</link>
<guid>http://www.techdirt.com/articles/20071205/190901.shtml</guid>
<description><![CDATA[ Back in the early days of the web, there were plenty of stories about a rather simple security breach on various sites.  Basically, many sites would simply pass a user's account number through as a part of the URL.  If a user simply changed the URL, her or she could see the account info of that other issue associated with the new number.  After a few such cases came to light, most web app designers quickly realized to plug that hole, and it's been quite some time since we've heard of a site with such a security hole.  However, it appears that there are still a few.  The site for Passport Canada, where people can apply for a Canadian passport apparently <a href="http://www.theglobeandmail.com/servlet/story/RTGAM.20071204.wpassport1204/BNStory/National/home">had exactly that security vulnerability</a>, allowing the guy who discovered it to see the passport application data of other applicants simply by adjusting the URL.  It's never nice to hear about a security flaw (especially on a gov't website with all sorts of private info), but it actually induces a bit of nostalgia to hear of such a basic security flaw showing up in the wild yet again.<br /><br /><a href="http://www.techdirt.com/articles/20071205/190901.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20071205/190901.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20071205/190901.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>that-one-again?</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20071205/190901</wfw:commentRss>
</item>
</channel>
</rss>