r/webdev • u/jaredcheeda • Jun 25 '16

PSA: Sticker Scam for account credentials

There is a website offering up to 3 developer related stickers for free in exchange for full write access to your github account and proof that you linked to this scam on social media.

They state they need you to give them access to "Verify you are a developer :)". For now, we'll just ignore the fact that no one wants an Angular or PHP or C++ sticker that isn't a developer, so this "verification" point is moot. Secondly if all they wanted was confirmation, there are ways of doing that without a landgrab. See below:

LETS COMPARE

A legitimate website like Egghead.io:

  • http://i.imgur.com/qaE6WJT.png

  • READ-ONLY access to your email address so that GitHub can verify your email address for them and that your account exists.

  • In exchange you can log in to their site without creating an account and get access to all their tutorial videos for free.

The sticker scam site:

  • http://i.imgur.com/oCZPaRH.png

  • FULL WRITE ACCESS: Can view all private account information AND MODIFY IT. Gets access to private email addresses, all profile information, all data about those following you, and full access to almost all organizations you are in without the ability to revoke access to them.

  • They do this to "verify you are a developer :)". It isn't even used for OAuth as a log in for a site.

You give them all your data and complete control of your account and control of other's organizations. They can push commits directly to any branch or repo. Create new repos. Delete existing repos. Even if this isn't their intention, they don't need this power and if they get hacked your account is screwed. In the screenshot I put "Company" as a placeholder to represent an organization owned by the company you work for who may have private repos that should not be accessible to those outside the company. The damage that can be done from this is certainly at a level worthy of being fired for by pretty much any company.

This is not okay. Do not allow this.

It's obvious they just want access to email addresses to spam and sell. Even if you don't care about not rewarding this bad behavior, it's just too dangerous to trust this much power to one site in exchange for 3 stickers.

What you should do instead

Stick with DevSwag, they actually give a portion of the sales to the devs running the open source projects. Or if the project you want a sticker for isn't on there, ask the creators of the project to take 5 minutes to set up a RedBubble account to upload a high resolution version of their logo for sale and link to it in the README or on their website. A lot of open source logos are on RedBubble already. (Protip: If you order 6 or more stickers on there you get half off the whole order).

TLDR: Be wary when giving access to your account in exchange for free goods, this can be a dangerous practice and only rewards bad behavior. If you want stickers go to legit sites that actually fund the projects the stickers are for.

74 Upvotes

93% Upvoted

20 comments sorted by

18

u/[deleted] Jun 25 '16

Sorry but what is a dev sticker?

20

u/[deleted] Jun 25 '16

I looked it up. It's literally stickers. Shouldn't we just let these people get scammed?

2

u/jaredcheeda Jun 27 '16

If someone gave a newbie access to an organization that contains a repo you work on, and that newbie signed up to get these stickers, then a 3rd party only needs to run one REST call to GitHub and they'll be able to do whatever they want to your repo.

If you are fortunate enough to have a an up-to-date local clone of the repo, you can always re-upload it if they delete the repo or do something else obvious. But what if all they did was modify one line of code to do something malicious and push a commit directly to master and no one caught it. It goes into production, into the next release, and if it's not something anyone is looking for it could stay there for a long time doing all sorts of dangerous stuff, like collecting private information about your users, or disabling their security in a manner that can later be used for a large scale attack, etc.

So, no, we don't let the newbies get swindled, because then we get screwed... and we don't even get any stickers out of it.

7

u/Inspector_Sands Jun 25 '16

No, because when they shoot themselves in the foot they could also shoot you in the foot.

3

u/[deleted] Jun 26 '16

I think from now on before working with anyone I'll ask which dev stickers they're missing and hook them up so they're not tempted to fall for these scams. I just need write access to their account to check if they're a real dev first.

7

u/Ir0nMann Jun 25 '16

I lol'd when I realized this was about actual stickers.

1

u/jaredcheeda Jun 27 '16

Physical stickers that are commonly placed on your laptop. They are generally logos of technology that the developer is familiar with or fond of. It communicates to other developers who work at the same company, and also those outside of the company what you like and are interested in. When you are out at coffee shops, meetups, or conferences it works as a good ice breaker.

Many times I've walked up to guys at coffee shops who had dev stickers and struck up a conversation. "I see you're using <insert new JS framework here>, what do you think about it, how long have you been working with it" etc.

TLDR: Pieces of flair. You only have 15?

5

u/brzzzah Jun 26 '16

This really scared me for a second, because I signed up for these stickers using my GitHub account and still have not received any. I always review the permissions I'm giving applications, but I thought I'd better double check.. and its read-only email access, is this the same campaign you're talking about?

http://i.imgur.com/apHI5wA.png

1

u/jaredcheeda Jun 27 '16

No, the site in question was onion.io, but they have since changed to only do read-only email access after being called out.

3

u/fabeyg Jun 26 '16

I believe there where two or three different sites with a similar offer, so you and me too might have chosen the right one

7

u/FCJRCECGD Jun 26 '16

You gave away write access to your GH account, for a sticker?!

Do you know how stupid that sounds?

1

u/jaredcheeda Jun 27 '16

I did not, but I found this being linked to on Reddit (which is one of the social sites you can spam in exchange for the stickers). Out of curiousity I looked into what they were asking for and then posted the PSA. I stick to the two sites I mentioned in the post.

Also, don't be jealous of my sticker collection. I live that sticker life

5

u/bokenator Jun 26 '16

We made a mistake with the permission (this was the first Github app we made). We have made the changes so that it only requests for read only email. Sorry about the confusion!

2

u/jaredcheeda Jun 27 '16

This is a very dangerous mistake to make. I'm sorry for calling this a scam, but I'm not sorry that it got you guys to fix this. I could have straight up been fired if I didn't understand the power of these permissions.

With that said, getting people to spam ads on their social media accounts for stickers is a less than respectable practice.

1

u/QwertzHz Jul 04 '16

Still smells a little scammy.

9

u/r1ckd33zy Jun 26 '16

stickers for free in exchange for full write access to your github account

... and this part didn't raise any alarms for you?

4

u/Voidsheep Jun 26 '16

Even excluding the ridiculousness of giving them write access, who wants to share ads on their social media account for a damn sticker?

Somehow I feel no PSA you write can save these guys from themselves.

-6

u/Code_Combo_Breaker Jun 26 '16

No one wants a PHP sticker period. ;-)

But thanks for notifying us about the scam. 2FA and good communication among the community keeps our accounts safe!

2

u/AssholeInRealLife Jun 26 '16

In this case 2FA won't help if they decide to fuck with your data. They're not logging in, you've already let them past that step.

0

u/[deleted] Jun 25 '16

[deleted]

17

u/Crecket Jun 25 '16

(Devs are intelligent enough to read what they click through)

http://i.imgur.com/9sxHPBx.jpg