Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“I Emailed 97,931 Users Their Passwords”

atechdad.com

Post reply on HN
Print view View original

51–60 of 72 posts

Re: “I Emailed 97,931 Users Their Passwords”

#51

Post by hartator »

mynameisvlad wrote: post #36
hartator wrote: post #14

Earlier quoted context omitted.

Sending unsolicited automated emails, even for good, may be considered rude as well.

Really? Do people seriously have this notion? Yes, sending actual spam is rude. But an unsolicited automated email can easily be deleted, especially if it's one time. I would never associate "rude" with that, maybe "annoying" at worst.

Another thing to consider, these emails were also sent as a way to educate people about web security. I am not surprised that unsolicited automated emails to educate oneself are considered rude by some people.

Also for ref: http://dontevenreply.com/view.php?post=99

Re: “I Emailed 97,931 Users Their Passwords”

#52

Post by julianj »

meburns wrote: post #50
julianj wrote: post #40

Earlier quoted context omitted.

It should be back now- that took much longer than I expected.

Down again for me :( Good news is you're very popular! :D

It's very weird. It looks good to me, but I do see half of the hits are coming in from a cached version. I'll have to prepare better if I'm to post another article and not melt down.

Re: “I Emailed 97,931 Users Their Passwords”

#54

Post by julianj »

meburns wrote: post #50
julianj wrote: post #40

Earlier quoted context omitted.

It should be back now- that took much longer than I expected.

Down again for me :( Good news is you're very popular! :D

I figured it out. The caching method cached the error page instead of the legitimate page. >Sorry about that.

Re: “I Emailed 97,931 Users Their Passwords”

#55

Post by meburns »

julianj wrote: post #52
meburns wrote: post #50

Earlier quoted context omitted.

Down again for me :( Good news is you're very popular! :D

It's very weird. It looks good to me, but I do see half of the hits are coming in from a cached version. I'll have to prepare better if I'm to post another article and not melt down.

Works now :D

Re: “I Emailed 97,931 Users Their Passwords”

#56

Post by antsar »

mynameisvlad wrote: post #32
antsar wrote: post #28

Earlier quoted context omitted.

How many mail clients load those by default nowadays? Gmail doesn't, Thunderbird doesn't.

Um, Gmail does: https://support.google.com/mail/answer/145919?hl=en > Gmail automatically shows you the images in your messages It does have an option to turn it off, but the default is on. They will load up the image themselves, then serve it from their domain, but, as the help information shows, that still indicates an "open", it's just that all the information on who opened the email (IP address, etc) would be wro…

D'oh, thanks for the correction! I knew about their caching mechanism, but failed to realize that it wouldn't prevent this sort of tracking pixel from working due to the pixel URL being unique (in most cases).

Re: “I Emailed 97,931 Users Their Passwords”

#57

Post by julianj »

pixl97 wrote: post #48
terminado wrote: post #22

This is a cute experiment, but unfortunately the integrity of the service is is easily corrupted. The biggest problem is being prone to misinformation. There's nothing to prevent people from posting arbitrary e-mail lists to pastebin, with purported matching passwords, as an effort to provoke your service to cry wolf. A few suggestions to harden the service: - provide integrity when sending the message by including a…

> There's nothing to prevent people from posting arbitrary e-mail lists to pastebin, with purported matching passwords Your password is: xttp://someporn.site.the/spammer_wants_you_to_visit

That's true. I would need to refine my regex. I guess anyone with a password that contains http:// or or some other nastiness would be SOL. :)

Re: “I Emailed 97,931 Users Their Passwords”

#58

Post by asddubs »

mynameisvlad wrote: post #10

> Including one request to F k off. If someone had just sent me an email letting me know that my email and password are out there in the wild, "fuck off" would not be my first reaction. That's just rude.

might have been someone who thought it was some sort of phishing-attempt

Re: “I Emailed 97,931 Users Their Passwords”

#59

Post by ocdtrekkie »

julianj wrote: post #39
ocdtrekkie wrote: post #11

Earlier quoted context omitted.

That would probably help. "Your password, xxxx, has been compromised." Even if they think it's spam, they should immediately realize they do need to change their password.

That's a good idea. Maybe a subject line like your password p *rd has been compromised.

Password is already compromised, so this is a worthless step. And only seeing part of the password may cause them to think it's largely still secure or something. (Some people don't understand wildcards.)

Re: “I Emailed 97,931 Users Their Passwords”

#60

Post by DanBC »

mynameisvlad wrote: post #36
hartator wrote: post #14

Earlier quoted context omitted.

Sending unsolicited automated emails, even for good, may be considered rude as well.

Really? Do people seriously have this notion? Yes, sending actual spam is rude. But an unsolicited automated email can easily be deleted, especially if it's one time. I would never associate "rude" with that, maybe "annoying" at worst.

But this is actual spam! It's bulk, and unsolicited. The content doesn't matter.
Post reply on HN