One of those instances when you really wish curses worked on whoever was pulling this stunt “may you and your descendants suffer the bites of 10000 fleas for 10000 nights as punishment for your misdeeds”
Internet Archive: Security breach alert
391–400 of 648 posts
Re: Internet Archive: Security breach alert
#392Earlier quoted context omitted.
If Troy authenticates the data, they can use that as an 'endorsement' when trying to sell it.
This. Typically HIBP attribution includes the email of the "submitter". Various data aggregators will contact them and buy the stolen data. Everybody wins* . * Exceptions apply.
Where on HIBP can I see the email of the submitter?
Re: Internet Archive: Security breach alert
#393Earlier quoted context omitted.
To enter? No. To borrow? Yes.
What are you "borrowing" from the Archive?
Books. (Until they're vanished by publishers. https://www.techdirt.com/2024/06/20/500000-books-have-been-d... )
Re: Internet Archive: Security breach alert
#394Just in terms of privacy, it's worth noting that anyone who has uploaded something on IA already has their email address publicly viewable. This isn't something that commonly known (even judging by comments here) but in the publicly viewable metadata of every upload it contains the uploader's IA account email address. So from a security perspective it's bad but from a privacy perspective a lot of users probably weren…
This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…
Whether the email is considered private or not is completely orthogonal to whether you are allowed / should tie an action to your email. And then again completely orthogonal whether you can/should make that connection public.
Even if your email is public information and even if what is uploaded is public information that doesn't imply that the email address behind the account that uploaded that information should be public.
Re: Internet Archive: Security breach alert
#395Earlier quoted context omitted.
It's a thankless job to be always begging for donations to keep something working when the Internet at large doesn't value it as much as it should. And now getting targeted like that? I wouldn't judge them if this is an official communication coming from exhausted and frustrated staff.
Just a reminder that AI tried pivoting to much more clear-cut legitimate piracy, presumably because they got bored or something, and certainly put ‘donations’ toward that effort. IA is an incredibly valuable resource, but let’s not put them on a pedestal.
What's "legitimate piracy"? As a reminder, the scheme was designed to work exactly like typical lending libraries. Publishers were unable to show any harm, and the only evidence available proved they actually benefited from better sales thanks to the Internet Archive. Authors were clearly benefited.
https://www.techdirt.com/2024/09/05/second-circuit-says-libr...
But I agree, no need to put them on a pedestal. Nobody is perfect.
Re: Internet Archive: Security breach alert
#396Earlier quoted context omitted.
Out of curiosity, do you use a unique email address for every single service?
Yes, without exception. I want to know who is leaking/selling my address, and usually stop doing business with those who do. It also makes filtering really easy. People sometimes have strange reactions when I verbally give them an email address with their company name in it, especially when I'm a new customer. All you need is a domain and an email provider that allows catch-all addresses, both of which are easy and c…
I do the same but use initials and random chars so hackers or employees can’t assume my email addresses for other sites/services.
e.g.: hn_t47fb@my.domain
Re: Internet Archive: Security breach alert
#397Earlier quoted context omitted.
Not the author but yes, I do. It’s trivially easy so why not?
Same here, only issue I’ve ever had was when my email address had the name of the company in it in the format of spamlklcompanyname@domain.com CS people are sometimes confused by that and I’ve been accused of attempting to hack them by a small shop online because of my email.
Major SMTP provider refused my email address as login because of this. Luckily my moaning eventually made its way to one of their developers who fixed it.
You can't sign up for a Samsung account with the name Samsung anywhere in your e-mail address. Aliexpress another offender. There my email is just spam@domain.
Re: Internet Archive: Security breach alert
#398Earlier quoted context omitted.
This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…
An issue is for most sites/services an email has just become a standard authentication method, rather than something that can easily be more unique per account. So any usernames across sites/services that share it identify that user as being the same person (for data broker profiling, doxxing, etc), which is the privacy issue (not the email address per se, unless it perhaps contained one's real name). For contrast tr…
> One could create entirely separate accounts but it's high friction and IIRC the
> same phone number (now a requirement) can only be used for 2-3 accounts.
I've wondered about this. Every Android/ChromeOS device I've ever bought, I had a new Google account created for it (during setup, instead of using an existing account), and only a few actually had phone numbers (I don't generally use smartphones for telephony). Is "Google account" synonymous with "GMail account" these days?
I've had this idea for an experiment where I get such a device (without a simcard), and see how many times I can iterate the Initialize-Device-With-New-Google-Acct-PowerWash-Repeat cycle, and how many Gmail accounts I would have as a result.
Re: Internet Archive: Security breach alert
#399Earlier quoted context omitted.
This raises an interesting question: should email addresses be private? Addresses of buildings aren't private, and they're somewhat analogous as with many computing concepts. (Aside: Before spam filters were quite good, it was typical to avoid scraping of addresses by mild obfuscation, but I think those days are gone, and this is distinct from privacy anyway.) If someone wants to upload and never be found out, then t…
There is software which is intended to e.g. locate the GitHub profiles of people working at companies, then scrape all public repositories they've contributed to for their email address and the emails of their coworkers - to enable targeted advertising to those individuals. Very common in enterprise sales. With ChatGPT, this can be extended to create emails that look very personal - as if someone has followed all of…
About AI slurping all information. I bet one of the first ideas organisations that spy on population had when the recent AI boom happened was: How about we just train our AI on all the intercepted data and just ask it? Is John Smith a terrorist (for our definition of terrorist)? And the AI would reply: Yes he it, he searched on Google where to buy these ingredients that can be used to make explosives. So then they go and figure out some way to "legally" arrest the guy and obtain more private info. It looks like the guy was buying the stuff because he's got a plot of land to fertilise and an old car to paint. So they ask the AI again. You said John Smith is a terrorist! And the AI would answer. I'm really sorry, I'm doing my best and I'll endeavour to do better in future. After this the agents ask for another billion $ because clearly they need more VRAM.
Re: Internet Archive: Security breach alert
#400Imagine if we could get rid of passwords. Entirely. Forever.