Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notion leaks email addresses of all editors of any public page

twitter.com

Post reply on HN
Print view View original

151–160 of 162 posts

Re: Notion leaks email addresses of all editors of any public page

#151

Post by canarias_mate »

varenc wrote: post #67
chinathrow wrote: post #42

Earlier quoted context omitted.

It's also trivially easy to fix. 1 min delete and deploy.

I'm guessing it's not trivial to fix without breaking other things? The weakness seems to be that anyone can turn UUIDs into details like email. But I assume this functionality is necessary for other flows so they can't just turn off all UUID->email/profile look ups. And similarly hiding author UUIDs on posts also isn't trivial. Conceptually, I agree it should be easy, but I suspect they're stuck with legacy code and…

[flagged]

Re: Notion leaks email addresses of all editors of any public page

#152

Post by shojivr »

rvz wrote: post #91

Why people choose these services and have zero care about security is beyond me. Tells me everything I need to know about this industry. No regard or seriousness to security at all.

because majority dont care about their security and prefer conveniences

Re: Notion leaks email addresses of all editors of any public page

#153

Post by Akuehne »

Two things. One, surely I'm not the only one who knew this data was being stored? Two, calling it a "leak" feels like a stretch when the data was publicly accessible by design from the start.

Yes, some users probably didn't realize their edits to public pages were saved publicly, and that's a legitimate UX complaint. But some of the responsibility has to sit with the user. Otherwise we'd be running daily headlines about Meta "leaking" user data to every advertiser with a checkbook.

Re: Notion leaks email addresses of all editors of any public page

#154

Post by mschoening »

janalsncm wrote: post #94
mschoening wrote: post #87

Earlier quoted context omitted.

When you start contributing to a page you see this: https://cleanshot.com/share/trYdqYFZ This is pretty meh. We will deploy more explicit messaging while we mitigate this properly.

The warning is too vague. “May become visible” kind of sounds like Notion doesn’t know whether they will become visible or not.

Just following up that we've made it more explicit while we work on this:

https://cleanshot.com/share/8yFpGVDQ

Re: Notion leaks email addresses of all editors of any public page

#156

Post by aucisson_masque »

blitzar wrote: post #138
aucisson_masque wrote: post #93

Earlier quoted context omitted.

> P.S: Some folks here have speculated that this should be a 1 minute fix. Unfortunately that is not the case. :( 4 years.

We have top men working on it right now

Haha

Re: Notion leaks email addresses of all editors of any public page

#157

Post by account42 »

UqWBcuFx6NV4r wrote: post #113
chinathrow wrote: post #42

Earlier quoted context omitted.

It's also trivially easy to fix. 1 min delete and deploy.

You literally don’t know that. Add this to the mammoth file titled “HN comments in which the author makes some completely unsubstantiated technical claim”

It literally is easy to fix. For example they could shut down the servers. Which is what they should do immediately if there is no faster fix for a privacy leak like that.

Re: Notion leaks email addresses of all editors of any public page

#158

Post by account42 »

mschoening wrote: post #75

Hi, this is Max from Notion. First: This is documented and we also warn users when they publish a page. But, that’s not good enough! Second: We don’t like this and are looking at ways to fix this either by removing the PII from the public endpoints or by replacing it with an email proxy similar to GitHub’s equivalent functionality for public commits. P.S: Some folks here have speculated that this should be a 1 minute…

For a PII leak like this, why do you think it's OK to wait for "looking at ways to fix this"? It you can't do anything better you shut those endpoints (or whole servers) down IMMEDIATELY and then deal with the fallout afterwards. Your attitude towards this is beyond unacceptable.

Re: Notion leaks email addresses of all editors of any public page

#159

Post by account42 »

steve1977 wrote: post #44
DropDead wrote: post #2

Big companys need to start caring more security and privacy of its users and employees

Maybe the board and shareholders of big companies need to be held accountable financially instead of being able to hide behind legal constructs.

Not just financially. When a corporation fucks up big time there needs to be actual jail time for executives - fines will just be passed on to the company (read regular schmuck employees).

Re: Notion leaks email addresses of all editors of any public page

#160

Post by account42 »

ramon156 wrote: post #136
hluska wrote: post #104

Earlier quoted context omitted.

That system has been invented already. It’s called civil law.

Considering the current president, it's going great! /s

Not every internet thread needs to be injected with your TDS.
Post reply on HN