Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone at BrowserStack is leaking users' email addresses

shkspr.mobi

Post reply on HN
Print view View original

11–20 of 123 posts

Re: Someone at BrowserStack is leaking users' email addresses

#11

Post by nurettin »

jstanley wrote: post #5

BrightData is another company offering hosted browsers who has also recently leaked private data, although they did email customers to warn them. I wonder if both of these companies were compromised by a shared vulnerability in headless Chrome? Or else just a coincidence that 2 headless browser companies got hacked at the same time? I run a headless browser fingerprinting project and have found that URLs that I only…

Brightdata? Isn't that the israeli firm formerly called luminati that sells you shady "high quality residential IPs" that you can rotate to scrape the web?

Re: Someone at BrowserStack is leaking users' email addresses

#12

Post by streblo »

Everyone in this thread suggesting a “data leak” or “compromise” is totally missing the fact that this is how Apollo works. This is often times overlooked by Apollo customers themselves. You have to opt out of customer data sharing (and in doing so lose out on the value of the product): https://knowledge.apollo.io/hc/en-us/articles/20727684184589...

Not commenting on whether this is good or ethical (or even totally legal), but this is what is happening behind the scenes.

Re: Someone at BrowserStack is leaking users' email addresses

#13

Post by gruez »

>After a brief discussion, the emailer told me they got my details from Apollo.io

The landing page for Apollo.io says it's a "AI sales platform". In other words, a CRM. My guess is that someone on the sales team uploaded the entire customer list for sales purposes, not realizing the privacy implications.

Re: Someone at BrowserStack is leaking users' email addresses

#14

Post by timpera »

nurettin wrote: post #11
jstanley wrote: post #5

BrightData is another company offering hosted browsers who has also recently leaked private data, although they did email customers to warn them. I wonder if both of these companies were compromised by a shared vulnerability in headless Chrome? Or else just a coincidence that 2 headless browser companies got hacked at the same time? I run a headless browser fingerprinting project and have found that URLs that I only…

Brightdata? Isn't that the israeli firm formerly called luminati that sells you shady "high quality residential IPs" that you can rotate to scrape the web?

Yes, that's the one. Their residential IPs service is one of the best ones, but their "ethically sourced proxies" claim seems dubious at best.

Re: Someone at BrowserStack is leaking users' email addresses

#15

Post by petcat »

> Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address.

I think a lot of services will "de-alias" the email addresses from these tricks to prevent alts, account spam, and to still target the "real" account holder email. So the old tricks like "+@" is not considered a unique email from "@". Unless your site-specific emails are completely new inbox aliases, then I don't think this is as effective as people think it is anymore.

Re: Someone at BrowserStack is leaking users' email addresses

#16

Post by gruez »

jen20 wrote: post #10
jofzar wrote: post #3

> BrowserStack routinely sell or give away their users' data. > A third-party service used by BrowserStack siphons off information to send to others. > An employee or contractor at BrowserStack is exfiltrating user data and transferring it elsewhere. Or the simpler answer, their db/email list has been compromised.

The simplest answer is they are voluntarily being scum and selling user data to make a quick buck. It’s almost universally true.

>and selling user data to make a quick buck

Are there actually companies that will pay you $$$ for a list of emails?

Re: Someone at BrowserStack is leaking users' email addresses

#17

Post by jstanley »

nurettin wrote: post #11
jstanley wrote: post #5

BrightData is another company offering hosted browsers who has also recently leaked private data, although they did email customers to warn them. I wonder if both of these companies were compromised by a shared vulnerability in headless Chrome? Or else just a coincidence that 2 headless browser companies got hacked at the same time? I run a headless browser fingerprinting project and have found that URLs that I only…

Brightdata? Isn't that the israeli firm formerly called luminati that sells you shady "high quality residential IPs" that you can rotate to scrape the web?

Yes. Their hosted browser service is one of the best ones out there.

Re: Someone at BrowserStack is leaking users' email addresses

#19

Post by gruez »

petcat wrote: post #15

> Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address. I think a lot of services will "de-alias" the email addresses from these tricks to prevent alts, account spam, and to still tar…

> So unless your site-specific emails are completely new inbox aliases, then I don't think this is as effective as people think it is anymore.

Even if it's a "new" alias, I often see people[1] using simple schemes to derive the address, eg. facebook@mydomain.example. With cheap LLMs it's not hard to automatically guess what the underlying pattern is.

edit:

[1] ie. in this very thread

Re: Someone at BrowserStack is leaking users' email addresses

#20

Post by Jaxan »

petcat wrote: post #15

> Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address. I think a lot of services will "de-alias" the email addresses from these tricks to prevent alts, account spam, and to still tar…

I just do @. It is sometimes confusing by when interacting with customer support ;-)
Post reply on HN