4 ms·
Firebase Database default settings make the entire database world-readable and world-writable by all "authenticated users". But once you have enabled authentica
by ProblemFactory 8y ago
Firebase Database default settings make the entire database world-readable and world-writable by all "authenticated users". But once you have enabled authentication, then that means anyone who signs into your app with a Google account. Restricting users to only access their own data requires understanding and writing "security rules".
It's the most irresponsible default I have seen in practice.
- z5h 8y agoI disagree. I bet if the default was no access, developers would simply enable all access (and not even realize they could restrict access to authenticated users). So the default is likely much safer than what would otherwise happen. Let's not forget that there is a security/permissions testing feature built right into Firebase. It would literally take 1 minute for a dev to ask and test: hey, can people read each other's data?
- rhizome 8y agodevelopers would simply enable all access (and not even realize they could restrict access to authenticated users). So the default is likely much safer than what would otherwise happen. That's not what "safer" means. You cannot say that that's what would happen, either.
- maxxxxx 8y agoWe are using a system called Kinvey and there it's the same . By default everyone can read everybody's data. You can restrict it but I don't understand why they don't have a restricted model as default.
- davideast 8y agoThat is not true. The default access is only to authenticated users.
- dunham 8y agoI'm not sure these cases are even using firebase's user authentication - the article is reporting plaintext username/passwords being stored in the databases.