Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SoundCloud Data Breach Now on HaveIBeenPwned

haveibeenpwned.com

Post reply on HN
Print view View original

101–110 of 113 posts

Re: SoundCloud Data Breach Now on HaveIBeenPwned

#101

Post by goblin89 »

storystarling wrote: post #99
goblin89 wrote: post #92

Earlier quoted context omitted.

My bet at the time was that they have a bunch of hidden extra limits based on account age, IP/user agent information, etc. If that is true, their problem is that they advertise the larger limits instead of the smaller limits (to get more users signed up), and that they do not communicate when their extra limits apply and instead straight up upsell you, which are both dark patterns.

That sounds plausible. I've had to implement similar reputation-based limits on my own backend just to keep inference costs from exploding, so I sympathize with the fraud prevention angle. Masking that as a generic quota issue to push an upsell is pretty hostile though.

The feeling of being gaslit, when I calculated and recalculated the length of my tracks and compared it with limits on their pricing page, was quite unpleasant.

Another possibility is maybe they reduced their limits from 3 to 2 hours of audio around the same time. I don’t know if it happened before or after my experience, did not read their blogs or press releases, only made sure I was well under whatever limits were currently listed on their pricing & plans page (I was probably under 2 hours as well, but as this point can’t be bothered to check). Perhaps that transition was chaotic and for some time their left hand did not know what the right hand is doing.

Re: SoundCloud Data Breach Now on HaveIBeenPwned

#102

Post by goblin89 »

storystarling wrote: post #96
LoganDark wrote: post #76

Earlier quoted context omitted.

That would explain why the front-end would allow you to attempt something that goes over your limits, but not why the back-end would reject something that doesn't go over your limits.

Fair point. I suspect it comes down to how they handle retries. If an upload times out but the counter already incremented, the system sees the space as used until an async cleanup job runs. It is really common to have ghost usage in eventually consistent systems.

That’s a possibility.

Re: SoundCloud Data Breach Now on HaveIBeenPwned

#103

Post by theandrewbailey »

thinker1972 wrote: post #86

People should be using email alias. 1 unique alias per 1 uniques service and websites for proper segregation. If any of the unique alias leaked or getting spammed you'd know where the source is and blocking that specific alias would limit the breach. Theres simplelogin.io, addy.io, firefox relay, apple hide-my-email, custom domain catchall etc for that.

I have my own domain, so I canary trap the email addresses I give out.

https://en.wikipedia.org/wiki/Canary_trap

Re: SoundCloud Data Breach Now on HaveIBeenPwned

#104

Post by charliebwrites »

karlgkk wrote: post #91
thinker1972 wrote: post #86

People should be using email alias. 1 unique alias per 1 uniques service and websites for proper segregation. If any of the unique alias leaked or getting spammed you'd know where the source is and blocking that specific alias would limit the breach. Theres simplelogin.io, addy.io, firefox relay, apple hide-my-email, custom domain catchall etc for that.

IMO use email providers that have that built in. Because if your alias provider goes down, you’re fucked. And considering it’s a much less stable business than an email provider, it’s more likely. If Gmail goes down in 20 years, it will be a major occurrence. If mailgoforward.fart goes down, you’re screwed. The advice is, as always, use a second mail address for “sensitive” providers. Use a password manager and two f…

> If Gmail goes down in 20 years, it will be a major occurrence. If mailgoforward.fart goes down, you’re screwed.

The technical equivalent of “if you default on a $100,000 loan you have a problem. If you default on a billion dollar loan the _bank_ has a problem.

Re: SoundCloud Data Breach Now on HaveIBeenPwned

#106

Post by Nextgrid »

gleenn wrote: post #62
al_borland wrote: post #49

I went through and deleted a bunch of accounts a while ago, SoundCloud being one of them. It looks like I don't show up in the breach. It's nice to know SoundCloud actually deleted my data, I'm never totally sure what happens on the backend.

In theory, it's a legal requirement based on GDPR and CCPA as well as many other new digital rights laws across Europe and many states in the USA. SoundCloud is probably big enough to do that correctly otherwise e.g. the GDPR penalty is a highish percentage of the company's total revenue which gives the laws a good amount of "teeth".

> the GDPR penalty is a highish percentage of the company's total revenue which gives the laws a good amount of "teeth"

Under 2% of GDPR complaints even result in fines. And that would require there to be grounds for a complaint - there's no way for an external user to tell whether the delete is actually done, and the DPA won't force them to submit to a third-party source code audit.

The GDPR has zero teeth. But don't take it from me, these guys have a bit more expertise than I do on this subject: https://noyb.eu/en/data-protection-day-5-misconceptions-abou...

Re: SoundCloud Data Breach Now on HaveIBeenPwned

#107

Post by jacquesm »

throwaway431234 wrote: post #70
jacquesm wrote: post #19

Earlier quoted context omitted.

You mean you never kept your originals but just uploaded and deleted the masters?

Date of publication (copyright) is important to a songwriter even if there are a hobbyist.

That was a solved problem before the days of the internet.

Re: SoundCloud Data Breach Now on HaveIBeenPwned

#108

Post by fencepost »

alexfoo wrote: post #50
fencepost wrote: post #48

So I guess I should watch out for scams being sent to "soundcloud@" on a personal domain. Oh no, how will I distinguish them from my legitimate banking email???

Clever spammers (there are some!) see the presence of company@ and assume the user will have similar emails for other accounts, so it might be worth trying ebays scams to ebay@ or banking scams to chase@ or boa@ . Sending is cheap so why not, you're not trying to fool everyone, only a few. I use a unique string per company but it's not guessable in advance, but it's obvious when looking at it and squinting a bit, for…

I have three different generations of email addresses associated with United Airlines that all receive spam. Never any disclosed breaches AFAIK, but clearly email addresses got out at several points. At some point I stopped bothering to check.

As for Soundcloud, the password I had saved for it and a tiny bit of profile information tells me a lot - a manually created password saved into a password manager, probably in 2010 or 2011 and unused after grabbing a single track.

Addresses for services I actually care about also get what's basically peppering, and have all had updates much more recently than the days of Blackberry devices.

Re: SoundCloud Data Breach Now on HaveIBeenPwned

#109

Post by extraduder_ire »

alexfoo wrote: post #50
fencepost wrote: post #48

So I guess I should watch out for scams being sent to "soundcloud@" on a personal domain. Oh no, how will I distinguish them from my legitimate banking email???

Clever spammers (there are some!) see the presence of company@ and assume the user will have similar emails for other accounts, so it might be worth trying ebays scams to ebay@ or banking scams to chase@ or boa@ . Sending is cheap so why not, you're not trying to fool everyone, only a few. I use a unique string per company but it's not guessable in advance, but it's obvious when looking at it and squinting a bit, for…

Has this happened to you before?

I can't imagine anyone spamming in such low quantities that they'll notice a pattern like company@ and act on it.

I have regularly gotten spam emails without a to, cc, or bcc field though. So I can't tell which email they were sent to. (my host doesn't bounce/drop them for some reason)

I do regularly do misspellings of the company name though, since that often trips the "invalid email" check on signup. e.g. twitter.

Re: SoundCloud Data Breach Now on HaveIBeenPwned

#110

Post by pluralmonad »

fragmede wrote: post #63
pluralmonad wrote: post #31

Earlier quoted context omitted.

Also, never give out a direct email address, always an alias.

and include a nonce. user+SoundCloud@gmail.com is obviously guessable. user+SoundCloudheuerue64@gmail.com ain't getting guessed.

I mean aliases provided by some service providers. Never been of fan of the + style pretend aliasing. Takes very little sophistication to extract the real email. A real forwarding alias does not expose the true email.
Post reply on HN