Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“I Emailed 97,931 Users Their Passwords”

atechdad.com

Post reply on HN
Print view View original

11–20 of 72 posts

Re: “I Emailed 97,931 Users Their Passwords”

#11

Post by ocdtrekkie »

kanusterkund wrote: post #7
ocdtrekkie wrote: post #4

This is a pretty useful service. I do check sites tracking these compromises on occasion, and I know at least one password I used before has been compromised, but it wasn't one I'd used in years. My biggest concern is that your subject line sounds like plenty of spam/phishing emails, and your URL may get blacklisted by email services if you do this often enough. From a slightly higher effort standpoint, you might be…

The problem isn't that the subject line sounds spammy, it's that the spam mails try to sound legitimate. This may in turn create problems for actually legit messages. Maybe putting the scraped password in the subject line catches the recipients' attention.

That would probably help. "Your password, xxxx, has been compromised." Even if they think it's spam, they should immediately realize they do need to change their password.

Re: “I Emailed 97,931 Users Their Passwords”

#14

Post by hartator »

mynameisvlad wrote: post #10

> Including one request to F k off. If someone had just sent me an email letting me know that my email and password are out there in the wild, "fuck off" would not be my first reaction. That's just rude.

Sending unsolicited automated emails, even for good, may be considered rude as well.

Re: “I Emailed 97,931 Users Their Passwords”

#15

Post by GigabyteCoin »

mynameisvlad wrote: post #10

> Including one request to F k off. If someone had just sent me an email letting me know that my email and password are out there in the wild, "fuck off" would not be my first reaction. That's just rude.

When you email over 97,000 people at once, you're bound to get some strange responses.

Re: “I Emailed 97,931 Users Their Passwords”

#16

Post by pluma »

jakejake wrote: post #8
nly wrote: post #6

While I support this valiant effort, aren't there often legal implications to doing this?

It might be considered spam for one thing. The emails are unsolicited and it might be seen as a subtle promotion of the urhack project. I'm not sure that collecting and sending the passwords is illegal but I'm sure that wouldn't stop some litigious person from causing grief.

They're definitely unsolicited. If they are also promotional, that would make them illegal -- at least in the EU.

Re: “I Emailed 97,931 Users Their Passwords”

#18

Post by BorisMelnik »

mynameisvlad wrote: post #10

> Including one request to F k off. If someone had just sent me an email letting me know that my email and password are out there in the wild, "fuck off" would not be my first reaction. That's just rude.

gotta figure out of every 97,000 people one person is probably intoxicated / on bath salts

Re: “I Emailed 97,931 Users Their Passwords”

#19

Post by DanBC »

Go careful. This is probably against the ToS of whatever internet services you're using.

> The thank you notes I got were sincere. One of them validated the entire effort when the person indicated that they use the same password for everything and wanted to know which account had been compromised

I hope they don't only change the password on that one site!

Post reply on HN