Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notion leaks email addresses of all editors of any public page

twitter.com

Post reply on HN
Print view View original

81–90 of 162 posts

Re: Notion leaks email addresses of all editors of any public page

#81

Post by reactordev »

varenc wrote: post #67
chinathrow wrote: post #42

Earlier quoted context omitted.

It's also trivially easy to fix. 1 min delete and deploy.

I'm guessing it's not trivial to fix without breaking other things? The weakness seems to be that anyone can turn UUIDs into details like email. But I assume this functionality is necessary for other flows so they can't just turn off all UUID->email/profile look ups. And similarly hiding author UUIDs on posts also isn't trivial. Conceptually, I agree it should be easy, but I suspect they're stuck with legacy code and…

This is a rendering artifact, nothing more. If you can tokenize and protect PII on your platform, you can protect PII on your public pages.

    if (metadata.is_public)
Simple fix.

Re: Notion leaks email addresses of all editors of any public page

#83

Post by ArchieScrivener »

chinathrow wrote: post #23
Tiberium wrote: post #16

Apparently this is officially documented at https://www.notion.com/help/public-pages-and-web-publishing#... buried in a note: > When you publish a Notion page to the web, the webpage’s metadata may include the names, profile photos, and email addresses associated with any Notion users that have contributed to the page.

This is, as a notion user with public pages, beyond stupid.

Don't attribute to stupidity what can be explained by malice.

Re: Notion leaks email addresses of all editors of any public page

#84

Post by wferrell »

mschoening wrote: post #75

Hi, this is Max from Notion. First: This is documented and we also warn users when they publish a page. But, that’s not good enough! Second: We don’t like this and are looking at ways to fix this either by removing the PII from the public endpoints or by replacing it with an email proxy similar to GitHub’s equivalent functionality for public commits. P.S: Some folks here have speculated that this should be a 1 minute…

Can you share the warning? I made a public page and would say it was not clear to me this was a consequence of doing that. The warning as I remember it (a month ago) makes it sound like the information on this page is going to be public -- not - oh yeah the email addresses of everyone who edited this page will also be leaked.

Re: Notion leaks email addresses of all editors of any public page

#85

Post by jdgiese »

I love Notion and use it extremely heavily. I've also built a few integrations with Notion. I think it's a great app that uses AI very well, and they continue improving. Hopefully they fix this though! Also, their API has recently been upgraded quite a bit and now supports database views as a first class object. I have a few other small requests regarding their public API.

Re: Notion leaks email addresses of all editors of any public page

#86

Post by Kye »

linsomniac wrote: post #34

Very timely. I literally ran a Claude prompt "compare and contrast Notion vs Obsidian" and flipped over to HN while it was thinking, and this comes up. Thanks HN!

Consider Trilium if the collaboration stuff people use Notion for isn't important. It's open source, uses SQLite, and does automatic daily and weekly backups.

https://triliumnotes.org/

Re: Notion leaks email addresses of all editors of any public page

#87

Post by mschoening »

wferrell wrote: post #84
mschoening wrote: post #75

Hi, this is Max from Notion. First: This is documented and we also warn users when they publish a page. But, that’s not good enough! Second: We don’t like this and are looking at ways to fix this either by removing the PII from the public endpoints or by replacing it with an email proxy similar to GitHub’s equivalent functionality for public commits. P.S: Some folks here have speculated that this should be a 1 minute…

Can you share the warning? I made a public page and would say it was not clear to me this was a consequence of doing that. The warning as I remember it (a month ago) makes it sound like the information on this page is going to be public -- not - oh yeah the email addresses of everyone who edited this page will also be leaked.

When you start contributing to a page you see this:

https://cleanshot.com/share/trYdqYFZ

This is pretty meh. We will deploy more explicit messaging while we mitigate this properly.

Re: Notion leaks email addresses of all editors of any public page

#88

Post by cm11 »

mschoening wrote: post #75

Hi, this is Max from Notion. First: This is documented and we also warn users when they publish a page. But, that’s not good enough! Second: We don’t like this and are looking at ways to fix this either by removing the PII from the public endpoints or by replacing it with an email proxy similar to GitHub’s equivalent functionality for public commits. P.S: Some folks here have speculated that this should be a 1 minute…

I will speculate that Notion has had more than one minute to fix it.

Re: Notion leaks email addresses of all editors of any public page

#89

Post by holoduke »

freedomben wrote: post #35
linsomniac wrote: post #34

Very timely. I literally ran a Claude prompt "compare and contrast Notion vs Obsidian" and flipped over to HN while it was thinking, and this comes up. Thanks HN!

For a personal knowledge base? I would stay far away from anything proprietary for personal notes. I love logseq though I'm increasingly worried it's abandonware

For the sake of staying a computer nerd I decided to put all my notes in a private GitHub repo with help of a local 5b Gemma4 LLM. Is working extremely well. It doesn't matter in what format i type. I Use opencode for entering new notes.

Re: Notion leaks email addresses of all editors of any public page

#90

Post by DANmode »

themafia wrote: post #45
sph wrote: post #32

Earlier quoted context omitted.

Good luck with that. Companies simply don't want to invest in security. It's simply cheaper to write a post-mortem and apology blog post after the fact. The sad thing is that people are used by now that anything they enter on a website is sooner or later going to be leaked, if not sold as if often happens with email addresses.

Sue them out of existence then.

This has been an ineffective plan for guaranteeing the rights of the citizen in this country.

A new default is needed.

Post reply on HN