_jvqm

no profile record

Submissions

Ask HN: I found a pretty extreme data leak and I'm not sure what to do

107 pointsby _jvqm4 tahun yang lalu116 comments

comments

4 tahun yang laludiscuss

Yes sir, not contesting any of that, Troy Hunt may receive an anonymous email soon.

4 tahun yang laludiscuss

Thanks for the laugh. Okay, guilty by association.

4 tahun yang laludiscuss

First, thank you very much for your comment, secondly, the anonymous person has forgotten to specifically highlight a certain detail

- The entity affected by this vulnerability is NOT a trustworthy company, it is not even a registered company. The service is or was operated by individuals and not under its own registered business entity.

They obviously do not wish to describe this service any further, but they want to assure you that no sane person would ever subscribe to it, yet there are thousands of paying active users.

4 tahun yang laludiscuss

Finding such a thing might be somewhat special, but (referring to your comment) having theoretical access to money is definitely not a special thing.

4 tahun yang laludiscuss

That seems like an unfit comparison. If anything, they have found your key on the sidewalk, sat inside the car for 10 seconds, and then left again.

4 tahun yang laludiscuss

I don't have access to anything. Besides, I'm surprised that they would be the only person you know that has access to money.

4 tahun yang laludiscuss

These statements stand unchanged. The usage of "pretty extreme" could be regarding the "quality" of data, not quantity. Compared to the usual data leaks on HIBP it seems like an occurrence that happens frequently and the affected user count is abysmally low. Some anonymous person might fire off an email to Troy Hunt regardless.

4 tahun yang laludiscuss

They are, or I wouldn’t be posting here, but I sincerely thank you for your concern and advice.

4 tahun yang laludiscuss

If there is something they will not do until they have spoken to an attorney it is exactly this..

4 tahun yang laludiscuss

While the anonymous person understands some of the responses, and will make super sure to do absolutely nil until they have spoken to an attorney (and obviously not access anything on purpose now), they too are a little bit surprised to see some users worried they might get kidnapped and similar.

It is like they have never seen any other regular person with money before.

4 tahun yang laludiscuss

No blogging.

4 tahun yang laludiscuss

I will tell an anonymous person to do this, but I’m not sure if Troy Hunt cares about a random one-of-thousands service and a few thousand affected users.

4 tahun yang laludiscuss

.. deliberately given it to burglars? Absolutely nil has happened besides finding this.

4 tahun yang laludiscuss

First of all, I'm only telling a story of another unnamed person - besides, what exactly are you so worried about?

4 tahun yang laludiscuss

That is not a very special occurrence. I’d argue you can find almost anyone with access to a million dollars online. Just go to Twitter or so.

4 tahun yang laludiscuss

Fair enough. I dont think they are planning to use any information.

4 tahun yang laludiscuss

It is not a honeypot, it’s a service that uses these API keys.

I am aware of the withdrawal logics.

4 tahun yang laludiscuss

Fair enough

4 tahun yang laludiscuss

They have been considering this too, but realistically this is a little known service, there are thousands of it like it, and the affected user count is only in the thousands. I don’t know if any of these people would care in the first place. I will tell an anonymous person to try regardless.

4 tahun yang laludiscuss

I have not committed any kind of crime. I'm just telling the story of another person.