Live data from Hacker News

Online Cheating Site AshleyMadison Hacked

krebsonsecurity.com

21–30 of 374 posts

Re: Online Cheating Site AshleyMadison Hacked

#22
post #21
post #9

It couldn't have happened to a more deserving site.

Illegal acts against people considered "deserving" is vigilantism, which is bad.

On the other hand, we have many forms of media that worship vigilantism... so this is obviously not a universally held truth.

Re: Online Cheating Site AshleyMadison Hacked

#23

The possibilities are endless, I imagine someone will make this data easily searchable and journalists will be digging through to found anyone of notoriety that was dumb enough to sign up with their own names and credit cards etc. This hack could create a ton of news stories, including record divorce rates. I'm curious as to how the ashley madison admins are killing these links? DMCA takedowns? What's the mechanism f…

There's another case to be considered here, too - people who have used the site, got caught/came clean, did the work to fix it and have rescued their marriages (or were doing it with the blessing of their spouse), and now are at risk for their name being published for viewing by their coworkers, neighbors, members of their church, etc as a "cheater", "adulterer", etc, even after they've ostensibly paid their moral debt.

There are certainly a lot of karma coming to a lot of people who deserve it, but there's also a lot of hurt coming to people who probably don't.

An unrelated thought: I can only imagine how giddy the staff over at Gawker must be right now. This is like the David Geithner story times 37 million.

Re: Online Cheating Site AshleyMadison Hacked

#25
post #6

Good. I hope the company goes bankrupt. People murder other people and kill themselves over shit like this.

People who commit murder and suicide over their insecurities and jealousies are responsible for their own actions.

How is this any different than creating a site that is a "marketplace" for cheating on your tests/essays/whatever in University? The cheaters are responsible for their own actions, right?

Re: Online Cheating Site AshleyMadison Hacked

#26
post #6

Good. I hope the company goes bankrupt. People murder other people and kill themselves over shit like this.

People who commit murder and suicide over their insecurities and jealousies are responsible for their own actions.

How is this any different than creating a site that is a "marketplace" for cheating on your tests/essays/whatever in University? The cheaters are responsible for their own actions, right?

Re: Online Cheating Site AshleyMadison Hacked

#27
Not too surprising. Security in the past has been worse than abysmal on that site. I had a friend that jokingly made an account and sent me a link to his profile. However, that link was also his entire session. Once in the profile section it would let you change the password without knowing the current password. And the last kicker, the change password box had asterisks in it on page load and a quick "view source" revealed my friend's "not joking" password all from a link that didn't look too important.

In summary:

  1. Having a session id just stored in a GET variable for (most?) pages.
  2. Use of http on profile edit page.
  3. Allowing password change without reauthentication
  4. Storing of all passwords without any form of hashing.
  5. Sending passwords over http every time the profile edit page was viewed
  6. Very easy for a user to accidentally share confidential data.
I want to say this was back in 2008 and the site was launched in 2001. I can't imagine that they are making any of these mistakes today but if the past incompetence has any relevance then this security disaster was a long time in the making.

Re: Online Cheating Site AshleyMadison Hacked

#28

Earlier quoted context omitted.

Why is it deserving of this? Genuinely interested.

Cheating can cause a lot of emotional harm. Imagine a site for people to commit minor sexual assaults and publish the pictures of the victims. That would be easier to think of as deserving of being hacked though neither is causing tangible physical harm. The article also gives the reason that they apparently falsely sold customers a "delete your information" fee without actually deleting it. That kind of fraud can on…

Cheating is legal. Publishing people's PII is not.

Re: Online Cheating Site AshleyMadison Hacked

#29
post #20

Earlier quoted context omitted.

Why is it deserving of this? Genuinely interested.

I don't understand why you're genuinely interested. Whether You agree with the statement or not, you already know why it was made. "Genuinely interested" here is just bate for someone to "genuinely" argue with you and waste their time.

Yep, and in another comment below we can see the trap sprung. It's more effective to just say your disagreement, really.

Re: Online Cheating Site AshleyMadison Hacked

#30

Earlier quoted context omitted.

Cheating can cause a lot of emotional harm. Imagine a site for people to commit minor sexual assaults and publish the pictures of the victims. That would be easier to think of as deserving of being hacked though neither is causing tangible physical harm. The article also gives the reason that they apparently falsely sold customers a "delete your information" fee without actually deleting it. That kind of fraud can on…

No. You are publishing pictures of someone without their permission. That is not the same.

Wouldn't you say the nature of the consequences are the same - emotional harm? Although you might judge the degree of harm differently. What problem can publishing pictures of assault cause the victim that doesn't happen with cheating?
Post reply on HN