API2:2023 — Broken Authentication

Slide 16 · Real Incident

70 terabytes. No authentication required.

Parler, January 2021 — what happens when API endpoints have no auth at all.

Real Incident · January 2021

Parler — 70TB of Data Scraped Before Shutdown

In early January 2021, before Amazon Web Services suspended Parler's hosting, a researcher discovered that Parler's API endpoints required no authentication. Posts, profiles, images, and videos were all publicly accessible without any token or session credential.

Compounding the issue: post IDs were sequential integers. There was no rate limiting. Researchers wrote scripts that iterated through every ID from 1 to the maximum, downloading everything.

Before the platform went offline, approximately 70 terabytes of data was archived — including GPS metadata embedded in videos. That metadata placed specific users at the US Capitol on January 6th, with precise coordinates and timestamps.

Lesson: "No authentication required" is not a design choice — it's an authentication failure. Every API endpoint that returns user data must require a valid credential, even for content the owner believes is "public."

Three failures in one incident

• No authentication on endpoints returning user data

• Sequential IDs making enumeration trivial (a BOLA failure too)

• No rate limiting allowing bulk scraping at full speed

Any one of these mitigated would have significantly slowed or stopped the scrape.

← Back What do all these have in common? →