4 ms·
Latin America's Stripe competitor (Mercado Pago) API Security Hole
- mauro_oto 11y agoIt's amazing given how big they are in Latin America how this went by unnoticed.
- etagwerker 11y agoYes. I wish they were more like Github or Stripe about disclosing this sort of information.
- Aldo_MX 11y agoThe title should be changed to something like "Latin America's Stripe competitor didn't validate access tokens", almost nobody from outside LATAM will ever know what Mercado Pago is, neither why the discussion of this vulnerability matters.
- the_af 11y agoIt's not a bad suggestion, but I'd keep Mercado Pago in the title as well. Mercado Libre/Pago is huge here in Latin America, and I wouldn't have read this post otherwise.
- etagwerker 11y agoI've updated the post title with your suggestions. Thanks!
- sogen 11y agoeBay is the largest common stocks owner in MercadoLibre
- wzy 11y agoDoes Stripe operate in Latin America? How can they be competitors?
- the_af 11y agoThey don't, as you can see here: https://support.stripe.com/questions/what-countries-does-stripe-support https://support.stripe.com/questions/what-countries-does-str... So you're right, Mercado Pago and Stripe are not in direct competition, just in the same business.
- mauro_oto 11y agoYeah, they don't operate in Latin America. Mercado Pago is Latin America's answer to Stripe, or PayPal, as I think they exist before Stripe came into scene.
- benologist 11y agoMercado Pago is 11 years old and part of the 16 year old Mercado Libre, which is like eBay and the number 1 Latin American ecommerce site.
- etagwerker 11y agoYeah, Mercado Pago has been around more than Stripe, but they are still rookies when it comes to their platform's security. See Stripe's Security section: https://stripe.com/help/security https://stripe.com/help/security I'm still trying to find Mercado Pago's Security section and security vulnerability protocol (e.g. Who do I contact when I find the next security hole?)
- benologist 11y agoJust because they're not doing it like Stripe doesn't mean they're rookies, they also did $7.1 billion in transactions last year. Most companies have pretty obscure/lacklustre security outreach, it's something that's getting a lot more emphasis these days than it used to.
- pbreit 11y agoSo what was the glitch?
- mauro_oto 11y agoTL;DR: You could provide a "lalala" secret, or "whatever", and it would provide you with an actual access token for any client ID you passed for Mercado Pago's production server.
- etagwerker 11y agoUsing their authentication mechanism, a user should only get an access token with the right combination of client id and client secret. For at least 7 hours, anyone could get an access token for any client id, without entering the right client secret. With that access token they could see a lot of information for any account.