Pope's official prayer app commits cardinal sin, leaks 700K+ users' info

Click To Pray, a prayer app endorsed by the Pope with hundreds of thousands of users worldwide, has leaked people’s names and email addresses for months - or longer - according to an ethical hacker who said she found and reported the security vulnerability six months ago to no avail. This app needs to take a vow of silence when …

[brainwrong]

I give up, What's a digit?

"One GET request per user. for i in range(1, 719518):" and "- so long as you supply a valid, five-digit user ID"

I guess god really does move in mysterious ways.

[steelpillow]

Re: I give up, What's a digit?

I am told the Devil prefers a two-digit sig.

[G.Y.]

3! Re: I give up, What's a digit?

3 digits: 666 (cf. Revelations)

[steviebuk]

Re: 3! I give up, What's a digit?

Or 616

[simonlb]

Re: I give up, What's a digit?

And lo the Lord spoke unto the masses, braking numerous GDPR regulations. And the EU responded with great vengeance and furious anger, smiting Him with a very large fine. And the vibe coding was then cast out as being an unworthy Agent of evil.

[Aladdin Sane]

Re: braking numerous GDPR regulations

Obviously trying to slow things down.

[Dave Pickles]

Re: I give up, What's a digit?

Five hex digits would suffice, but with not much room for future growth.

[herman]

Re: I give up, What's a digit?

Hex you say? - Bring the Malleus Maleficarum!

[You aint sin me, roit]

Re: I give up, What's a digit?

A witch! We have found a witch. May we burn her?

[Excused Boots]

Re: I give up, What's a digit?

Well she did turn me into a newt - I got better!

[MachDiamond]

Re: I give up, What's a digit?

"Five hex digits would suffice, but with not much room for future growth."

Welllll, the number of people that claim to hold religious beliefs has, by some polls, been falling.

[Aladdin Sane]

Re: I give up, What's a digit?

How about those that actually follow their alleged religious beliefs?

[TimMaher]

Re: I give up, What's a digit?

It’s something they stick you with when they are not being very nice.

[Anonymous Coward]

Is this fixable?

We'll gave to Pontificate on that*.

* It is probably an ecumenical question.

[Korev]

Re: Is this fixable?

That would be an ecumenical matter

[owlstead]

That's what you get when you rely on prayers instead of professionals. Probably created by Nephewsoft LTD.

[T. F. M. Reader]

Wasn't nepotism invented in the Vatican?

[Anonymous Coward]

That and one particular form of child labour.

What? Too soon?

[graemep]

No, its much, much older. There is probably a Babylonian clay tablet somewhere complaining about nepotism.

[Ken Y-N]

Coding by Father Dougal McGuire, customer support by Father Jack Hackett.

[chuckufarley]

OK, for the record...

...I do not want to touch what this leaks! Not even with class 23 hazmat PPE. Thanks for sharing. Do you know where your towel is?

[Benegesserict Cumbersomberbatch]

For what profits a man if he gains 719518 pieces of personal identifying information, but loses his immortal soul?

[Groo The Wanderer - A Canuck]

"Token limit exceeded - you're going to hell!"

[steelpillow]

A deceased person walks up the the pearly gates.

St. Peter: "What's your user ID?"

DP: "What user ID?

St. Peter: "Your prayer app."

DP: "I prayed for real, on my knees in churches."

St. Peter: "Computer says no!"

DP: "AAAAAAaaaaaaaarrrrrgggggghhhhh....... . . . . "

[Ken Shabby]

The entire network runs on a 2,000-year-old legacy system protected by layers of guilt, incense, and a guy named Peter at the gate.

[Bebu sa Ware]

A guy named Peter at the gate.

Just hope his database containing the details of who gets in (and the details of the presumably vastly larger list of who doesn't) isn't leaked.

"Good to see you (finally) Mr Lama.Go straight in sir, you're expected."

"Sorry Mr President, I have down for the barbeque in the basement. Better not dawdle, downstairs is rather impatient and you are well overdue."

…

[You aint sin me, roit]

Let him that hath understanding count the number of the beast, for it is the number of a man

[Boris the Cockroach]

Oh god.. just send me to hell already without having to listen to that bloody song again.

Flames.... anyway Geezer Butler is much better than harris

[Benegesserict Cumbersomberbatch]

Has Peter released the public keys to the kingdom of heaven yet?

[herman]

Holy smoke

Holier than than the Swiss cheese of the guard

[just4this]

Re: Holy smoke

Possibly, but not as holy as the holy hand grenade of antioch.

[Excused Boots]

Re: Holy smoke

Then shalt thou count to three, no more, no less. Three shall be the number thou shalt count, and the number of the counting shall be three.

[Ensign Nemo]

Click to prey

[just4this]

Could be worse.

Prayers are not a valuable target.

Imagine the amount of targeted ad spam a leak at emailSanta.com would generate.

[Paul Herber]

Re: Could be worse.

Santa is disl ... disslex .. can't spell, so messages went to emailSatan.com instead.

[Annihilator]

Re: Could be worse.

Arguably this is the *most* valuable target. 700,000 gullible contact details? Yes please.

[MachDiamond]

Re: Could be worse.

"Prayers are not a valuable target."

Somebody using the app is more likely to be a more devout adherent to the church, which is a handy data point to put in the file. It's one thing to put down "Catholic" in the field, but if you can assign a rating of 1-10 as well, that's much better. Many people will be raised in a certain religion and claim it, but not be particularly devout. Somebody that's a member of the Pillar of Fire Repentance Tabernacle and never misses a Tuesday might get a 9 or 10.

[Brave Coward]

So deceptive

So Click to Pray wasn't the almighty weapon to force the legions of evil to recede from the face of the world, but just another

Prick to Clay?

[Phil O'Sophical]

Register?

Why would you need to register to use such an app? An omnipotent God would know who the prayer is from...

[Paul Herber]

Re: Register?

If prayer worked it would have been banned centuries/millennia ago.

P.S. who wrote the test spec for this prayer app?

[Yet Another Anonymous coward]

Re: Register?

So they can sign you up for extra products. Like their new credit card with PrayerMiles (tm)

[MachDiamond]

Re: Register?

"So they can sign you up for extra products. Like their new credit card with PrayerMiles (tm)"

Does it tell you if the product you are trying to save a few bucks on is produced by idolatress sinners and not approved by the church something like how the Fosterites have commercial relationships.

[Yet Another Anonymous coward]

Re: Register?

You get 1% off purgatory for all sins and a bonus 2% off on your 3 favourite categories of sins

[Winkypop]

Personal Information

No big deal.

Doesn’t the Big Guy already know when you’ve been naughty or nice?

Oh sorry, wrong imaginary being.

[Uh, Mike]

Garbage-in

Now that the Streisand Effect is upon the subject website, what can a million or two imaginations cook up overnight?

[TeeCee]

And now The Lesson.

So it came to pass that demon spake unto the darkness in the world the mystic incantation of 1, 719518.

And Lo, it came to pass that the details of all the faithful could be seen by one and all.

And many were sore vexed by this.

And there was much weeping and wailing and gnashing of teeth.

And one spake out into the tumult; "Can it not be made that our information be made secret by means of an application update before he of the world and also his dog be aware of them?"

And a great voice replied; "Fear not, for those who seek to exploit My faithful shall suffer My wrath and the full vengeance of The Lord shall fall upon them!"

And the faithful saw that all was good and that the evildoers would be punished.

Vulnerabilities 8:14

[Paul Herber]

Re: And now The Lesson.

Most people agree that Vulnerabilities 7:xx was far better.

[spireite]

The church has failed penetration testing for years with their flocks, so why should their website be any different?

[Anonymous Coward]

Scripture app

Years ago I decompiled the official scripture app for a well known religious organization.

It had "telemetry" that tracked every scripture the user selected, how long they read the section and recorded anything the user highlighted and sent all that data back to the church and Facebook.

[Benegesserict Cumbersomberbatch]

Re: Scripture app

Did it raise a flag when the user got to the bit about volcanoes, and thermonuclear weapons, and spaceships that look like DC-8s without turbofans? That costs a lot extra.

[Paul Herber]

Re: Scripture app

Was the data just Numbers ?

[Nonqua]

Currently returns

https://api[.]clicktopray.org/user/users/{id}

{

"id": number,

"person": {

"id": number,

"first_name": string,

"last_name": string

},

"multimedia": null

}

[itnomad]

Just give us the confession!

[IamAProton]

Jesus Christ!

I can understand the "get user id details", but returning the hash in the response, that's dumb!

[Frank Bitterlich]

Surprised

I'm really surprised... so you're saying the catholic church did not respond to notifications that things are going sideways in their organization and that people are at risk? That is so unexpected.