Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“I Emailed 97,931 Users Their Passwords”

atechdad.com

Post reply on HN
Print view View original

31–40 of 72 posts

Re: “I Emailed 97,931 Users Their Passwords”

#31

Post by semi-extrinsic »

mason240 wrote: post #25
mfoy_ wrote: post #20

Earlier quoted context omitted.

Is there any reliable way to do this? Most mail clients will block receipt-type stuff by default...

I believe the trick is to put a hidden, 1px image in the email. Then you can track how many times it was requested.

Assuming people read their email in HTML and has their email client set/defaulting to automatically requesting external content. Sure, for a large sample from non-technical audience such as here it's probably a good assumption, but it may not be for e.g. a small sample from a tech-savvy audience.

Re: “I Emailed 97,931 Users Their Passwords”

#32

Post by mynameisvlad »

antsar wrote: post #28
mason240 wrote: post #25

Earlier quoted context omitted.

I believe the trick is to put a hidden, 1px image in the email. Then you can track how many times it was requested.

How many mail clients load those by default nowadays? Gmail doesn't, Thunderbird doesn't.

Um, Gmail does: https://support.google.com/mail/answer/145919?hl=en

> Gmail automatically shows you the images in your messages

It does have an option to turn it off, but the default is on. They will load up the image themselves, then serve it from their domain, but, as the help information shows, that still indicates an "open", it's just that all the information on who opened the email (IP address, etc) would be wrong.

Re: “I Emailed 97,931 Users Their Passwords”

#33

Post by julianj »

terminado wrote: post #22

This is a cute experiment, but unfortunately the integrity of the service is is easily corrupted. The biggest problem is being prone to misinformation. There's nothing to prevent people from posting arbitrary e-mail lists to pastebin, with purported matching passwords, as an effort to provoke your service to cry wolf. A few suggestions to harden the service: - provide integrity when sending the message by including a…

These are very good points. 1. Good idea 2. Good point, however, these credentials are usually already posted in public forums. My thoughts were that the risk was already present-- and the person who potentially didn't know was the user. 3. I am patiently waiting on let's encrypt. As a side project with no income, I cannot justify the cost of a certificate. 4. I found based on some responses that some of the credentials were old. It was not my intention to verify exposure, but let the user know that I found a password. If the person recognizes it for any account, change it.

I don't know if this is a service that can be maintained for any period of time, but hopefully the unexpected emails helped someone before the service could be abused.

Re: “I Emailed 97,931 Users Their Passwords”

#34

Post by julianj »

scarecrowbob wrote: post #21
Aardwolf wrote: post #12

Earlier quoted context omitted.

Thanks :) Since it says "Error establishing a database connection", I wonder if someone misused the password of their database?

Naw, that's what happens when WordPress is overtaxed.

Yeah-- I was not expecting this kind of traffic- I am reizing.... the box, hopefully this resolves the issue very soon.

Re: “I Emailed 97,931 Users Their Passwords”

#36

Post by mynameisvlad »

hartator wrote: post #14
mynameisvlad wrote: post #10

> Including one request to F k off. If someone had just sent me an email letting me know that my email and password are out there in the wild, "fuck off" would not be my first reaction. That's just rude.

Sending unsolicited automated emails, even for good, may be considered rude as well.

Really? Do people seriously have this notion? Yes, sending actual spam is rude. But an unsolicited automated email can easily be deleted, especially if it's one time. I would never associate "rude" with that, maybe "annoying" at worst.

Re: “I Emailed 97,931 Users Their Passwords”

#38

Post by jwcrux »

harrisonjackson wrote: post #2

Nice work! At a glance, the email you sent out does look sort of spammy. If you plan on doing it again you might get better feedback by making it a bit more human - ie "I'm just a guy/gal trying to help yall out - hope you don't use this password everywhere because someone posted it to pastebin.... - have a good one!" or something like that. Out of curiosity - what did you use to scrape pastebin?

I created a Twitter bot called @dumpmon (recently suspended for no apparent reason) that scraped paste sites looking for password dumps and tweeting if one was found.

You can find the code here: http://github.com/jordan-wright/dumpmon.

Here are some stats if anyone is interested in what it collected over approx. 2 years: http://jordan-wright.com/blog/2015/05/26/two-years-of-at-dum...

Re: “I Emailed 97,931 Users Their Passwords”

#39

Post by julianj »

ocdtrekkie wrote: post #11
kanusterkund wrote: post #7

Earlier quoted context omitted.

The problem isn't that the subject line sounds spammy, it's that the spam mails try to sound legitimate. This may in turn create problems for actually legit messages. Maybe putting the scraped password in the subject line catches the recipients' attention.

That would probably help. "Your password, xxxx, has been compromised." Even if they think it's spam, they should immediately realize they do need to change their password.

That's a good idea. Maybe a subject line like your password p*rd has been compromised.

Re: “I Emailed 97,931 Users Their Passwords”

#40

Post by julianj »

meburns wrote: post #24
Aardwolf wrote: post #12

Earlier quoted context omitted.

Thanks :) Since it says "Error establishing a database connection", I wonder if someone misused the password of their database?

I think scarecrowbob is right, but it would be very ironic if his site's DB pass was compromised ;)

It should be back now- that took much longer than I expected.
Post reply on HN