“I Emailed 97,931 Users Their Passwords”
atechdad.com
“I Emailed 97,931 Users Their Passwords”
1–10 of 72 posts
Re: “I Emailed 97,931 Users Their Passwords”
#2Nice work! At a glance, the email you sent out does look sort of spammy. If you plan on doing it again you might get better feedback by making it a bit more human - ie "I'm just a guy/gal trying to help yall out - hope you don't use this password everywhere because someone posted it to pastebin.... - have a good one!" or something like that. Out of curiosity - what did you use to scrape pastebin?
Re: “I Emailed 97,931 Users Their Passwords”
#3Nice work! At a glance, the email you sent out does look sort of spammy. If you plan on doing it again you might get better feedback by making it a bit more human - ie "I'm just a guy/gal trying to help yall out - hope you don't use this password everywhere because someone posted it to pastebin.... - have a good one!" or something like that. Out of curiosity - what did you use to scrape pastebin?
That's a good idea. I will give that a shot. To scrape pastebin I used a mutated version of a python script by Xavier Garcia. The only change I made was to save a copy of the paste.
The version I adapted is located here: http://www.shellguardians.com/2011/07/monitoring-pastebin-le...
Re: “I Emailed 97,931 Users Their Passwords”
#4This is a pretty useful service. I do check sites tracking these compromises on occasion, and I know at least one password I used before has been compromised, but it wasn't one I'd used in years.
My biggest concern is that your subject line sounds like plenty of spam/phishing emails, and your URL may get blacklisted by email services if you do this often enough.
From a slightly higher effort standpoint, you might be able to work with major email service providers to ship these notifications to users in a more official capacity.
Re: “I Emailed 97,931 Users Their Passwords”
#5This is awesome, very nice of you. Many thanks to you!
Re: “I Emailed 97,931 Users Their Passwords”
#6While I support this valiant effort, aren't there often legal implications to doing this?
Re: “I Emailed 97,931 Users Their Passwords”
#7This is a pretty useful service. I do check sites tracking these compromises on occasion, and I know at least one password I used before has been compromised, but it wasn't one I'd used in years. My biggest concern is that your subject line sounds like plenty of spam/phishing emails, and your URL may get blacklisted by email services if you do this often enough. From a slightly higher effort standpoint, you might be…
The problem isn't that the subject line sounds spammy, it's that the spam mails try to sound legitimate. This may in turn create problems for actually legit messages.
Maybe putting the scraped password in the subject line catches the recipients' attention.
Re: “I Emailed 97,931 Users Their Passwords”
#8While I support this valiant effort, aren't there often legal implications to doing this?
It might be considered spam for one thing. The emails are unsolicited and it might be seen as a subtle promotion of the urhack project. I'm not sure that collecting and sending the passwords is illegal but I'm sure that wouldn't stop some litigious person from causing grief.
Re: “I Emailed 97,931 Users Their Passwords”
#9cached version -> http://webcache.googleusercontent.com/search?q=cache:tQP6ur9...
Re: “I Emailed 97,931 Users Their Passwords”
#10> Including one request to Fk off.
If someone had just sent me an email letting me know that my email and password are out there in the wild, "fuck off" would not be my first reaction. That's just rude.