mlcreater wrote:

This does not really put users at risk because most unshared projects have no sensitive data in them.

Even if a project did, nobody could find it because there are 530 000 000 projects to look through

crabraveprogrammer wrote:

mlcreater wrote:

This does not really put users at risk because most unshared projects have no sensitive data in them.

Even if a project did, nobody could find it because there are 530 000 000 projects to look through

Auctually, one user has an unshared project that contains data on how to hack Appel, and that user got hacked some time ago. If there is a way to get a list of ALL projects by a user, then Appel could be in danger…..

mlcreater wrote:

crabraveprogrammer wrote:

mlcreater wrote:

This does not really put users at risk because most unshared projects have no sensitive data in them.

Even if a project did, nobody could find it because there are 530 000 000 projects to look through

Auctually, one user has an unshared project that contains data on how to hack Appel, and that user got hacked some time ago. If there is a way to get a list of ALL projects by a user, then Appel could be in danger…..

There is not a list of all projects by a user.

What would it mean to “hack” Appel or any other Scratch project?

when page opened :: events hat
if <project is shared ? :: operators> then
open project :: custom 
else
error :: looks //Oops! It's unshared!
end

when page opened :: events hat
open project :: custom //Hey, API! Open it up!

define open project
//Woo-hoo, let's go!
continue :: grey

when page opened :: events hat
open project :: custom //Hey, API! Open it up!

define open project
//Oops, it's unshared!
if <project is shared ? :: operators> then
continue :: grey
else
error :: looks
end

Chiroyce wrote:

Yes I do agree, but if you don't want to risk your privacy, simply don't give out your project ID.

IMO Scratch could do something like this

Client:      GET /projects/488029945

Server:     GET https://api.scratch.mit.edu/projects/488029945 

                if is_published == true
                    return project             // If yes, send the project to the client ==>
                else if sessionID matches project owner
                    return project             
                else
                    send 404

Same should be done for https://projects.scratch.mit.edu/488029945

crabraveprogrammer wrote:

Actuaully you have to check the password, but luckily there is a perfectly secure way of sending passwords to the server (HTTPS encryption)

crabraveprogrammer wrote:

if decryptedpassword == userpassword

example_password = "abcd1234"
hash(example_password) // server hashes the password after receiving it
server_stored_password = "e9cee71ab932fde863338d08be4de9dfe39ea049bdafb342ce659ec5450b69ae"

Chiroyce wrote:

crabraveprogrammer wrote:

Actuaully you have to check the password, but luckily there is a perfectly secure way of sending passwords to the server (HTTPS encryption)

C'mon dude, no one checks the password! It's always done with the sessionID cookie, and the server corresponding it with the data stored there, we only send passwords via https when we're signing in, no where else!

also, how do you think someone is gonna use https encryption in a URL? it's only encrypted just before leaving the browser, so your browser history might save the un-encrypted password, which is a huge security risk.

crabraveprogrammer wrote:

if decryptedpassword == userpassword

How would that work? The sever hashes the password and stores it, and you can't dehash a hashed value

example_password = "abcd1234"
hash(example_password) // server hashes the password after receiving it
server_stored_password = "e9cee71ab932fde863338d08be4de9dfe39ea049bdafb342ce659ec5450b69ae"

the above example used the sha256 hashing algorithm to hash.

crabraveprogrammer wrote:

Obviously you would encrypt the password when it is sent, then hash it to check if it matches.

crabraveprogrammer wrote:

IF YOU HAVE SENSITIVE DATA IN AN UNSHARED PROJECT, you must manually delete all of the sprites. Just putting projects into the trash and emptying the trash doesn't actually do anything.

D-ScratchNinja wrote:

You know what, I'm wondering if they didn't set it up in a way that you couldn't view unshared projects with the API because in Scratch 1 there was no unshared state, you would share projects from the desktop program and not edit online. When they updated to the next major version of Scratch, they may not have added a feature to the API that actually hides unshared projects because they didn't need to before. Just a theory.

crabraveprogrammer wrote:

Auctually, one user has an unshared project that contains data on how to hack Appel, and that user got hacked some time ago. If there is a way to get a list of ALL projects by a user, then Appel could be in danger…..

crabraveprogrammer wrote:

Currently, if you try to load an unshared project, Scratch will refuse to load it. But the project itself is still stored unencrypted on the server. So, if you want to see an unshared project, go on to something like turbowarp, forphorus, llk.github.io/scratch-gui, etc. It is pointless to hide unshared projects, if a person really wanted too, the could get on to it.

Many users share sensitive data in unshared projects (probably) and it is way too easy to get on to an unshared project.

One way is too have the API take in the users password. If it doesn't match, PHP will refuse to send back the project, thereby making it almost impossible to hack on to an unshared project.

IF YOU HAVE SENSITIVE DATA IN AN UNSHARED PROJECT, you must manually delete all of the sprites. Just putting projects into the trash and emptying the trash doesn't actually do anything.