555
Pope's official prayer app commits cardinal sin, leaks 700K+ users' info
(www.theregister.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 25 Jul 2026
555 points (98.8% liked)
Technology
88491 readers
3458 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
My God, that's horrific. Plus it doesn't even delete your data if you delete your account, it's still vulnerable.
I wonder of the vatican is part of the gdpr...
Would be funny to read about the church getting sued for that.
I don't know much about GDPR… is it illegal to have badly written software like this? Technically the user is bypassing normal usage and "hacking" the API
Negligence to delete the account data after termination is a reason to be fined.
They don't need to keep that data.
Afaik the only reason would be if MTX were offered (for book-keeping reasons)
It is illegal to keep deleted profiles
Yes, especially once you have been informed about it
5 digit user ids, yet over 700k users? Im sure they must have gone up to 6 digits
I tried the endpoint. 5 digits always gives you a valid user, 6 stops working after some point.
They probably meant 6 digit and it was a typo. The rest of the article references 6 digits. If it's just an integer (highly likely) it would go up to 10 digits or roughly 2 billion max users. My old coworkers and I used to joke that hitting
INTEGER.MAX_VALUEfor your customer ID is a good problem to haveUnless by “digit” they mean any alphanumeric.
You’ve got a lot of options if you go to a 5 characters with letters.
Which they’d kind of have to with 700k users if it’s 5 characters.
If it’s case insensitive, you’ve got 60,000,000+ combinations, and if case sensitive then 916,000,000+ combinations.
It's numerical only, but the number doesn't need leading 0s so anything from 1 to 6 digits might be a valid user ID.
That would be an absolute nightmare to administer lol. Though I guess that tracks.
1, 01, 001, 0001, and 00001 would all be different users
Good point, could easily be hex or some higher base
It sill works, you get first name and last name.
Maybe I should remove that from my comment lol, I feel like I'm contributing to a data breach or something
It is in the article doesn't matter if you remove it. The moment the article became public it is already too late.
I know, but a lot of people don't click the article, they just look at headline + comments, so it's still a reduction of visibility or an extra step. My comment is like exposing the endpoint right there front and centre. Plus, I don't like being personally responsible for any data breach. Maybe it's just a tiny thing but it felt like the right thing to do
What's more, scammers now have a list of 750k people known for their gullibility