2 ms·

Preliminary report out from Let's Encrypt: https://community.letsencrypt.org/t/email-address-disclosures-preliminary-report-june-11-2016/16867 https://community

Preliminary report out from Let's Encrypt: https://community.letsencrypt.org/t/email-address-disclosures-preliminary-report-june-11-2016/16867 https://community.letsencrypt.org/t/email-address-disclosure... as far as I know, all emails starting with 0-9, A-Z and at least part of 'a' were exposed. I did not get one starting with 'g', so it's somewhere between 'a' and 'g' that it got stopped. Edit: "7,618 out of approximately 383,000 emails" were sent out

mholt 10y ago
Was just able to confirm, it's up to and including your email address. Mine starts with m so I see 3,761 email addresses. But for me, none lexicographically after my email address are exposed. Edit: Just want to add that I've made a similar mistake before (with a smaller user base). So I understand how easily these bugs occur. Given all their progress in the last few years, I still believe that the privacy and security of such a large portion of the Web could not be in better hands. Props to the LE team for a quick, responsible response.
- turbohedgehog 10y ago
  You mean M, not m. (it's in ASCII order). Also giving out the number of addresses you see will allow someone after yours to connect your username with your email address if you weren't aware.
  - mholt 10y ago
    Yes, sorry, "M". And if this comment[1] is true, then that number won't reveal much. Their mailer is probably distributed across several nodes. [1] https://news.ycombinator.com/item?id=11881953 https://news.ycombinator.com/item?id=11881953
    - turbohedgehog 10y ago
      Multiple different images and a pastebin I saw posted on twitter showed the same starting set of emails.
andrewstuart2 10y ago
I also didn't get one, and mine starts with "an." So a good chance they caught it pretty early.
- andrewstuart2 10y ago
  Or, perhaps it's just been too long since I've used it actively? Sounds like parent did in fact have their email at least in the body somewhere, even if they didn't get one sent to them. Perhaps I'm the same.
killwhitey 10y ago
Mine starts with 'ab' and is ~7200 on the list

mholt 10y ago

Was just able to confirm, it's up to and including your email address. Mine starts with m so I see 3,761 email addresses. But for me, none lexicographically after my email address are exposed. Edit: Just want to add that I've made a similar mistake before (with a smaller user base). So I understand how easily these bugs occur. Given all their progress in the last few years, I still believe that the privacy and security of such a large portion of the Web could not be in better hands. Props to the LE team for a quick, responsible response.

turbohedgehog 10y ago
You mean M, not m. (it's in ASCII order). Also giving out the number of addresses you see will allow someone after yours to connect your username with your email address if you weren't aware.
- mholt 10y ago
  Yes, sorry, "M". And if this comment[1] is true, then that number won't reveal much. Their mailer is probably distributed across several nodes. [1] https://news.ycombinator.com/item?id=11881953 https://news.ycombinator.com/item?id=11881953
  - turbohedgehog 10y ago
    Multiple different images and a pastebin I saw posted on twitter showed the same starting set of emails.

andrewstuart2 10y ago

I also didn't get one, and mine starts with "an." So a good chance they caught it pretty early.

andrewstuart2 10y ago
Or, perhaps it's just been too long since I've used it actively? Sounds like parent did in fact have their email at least in the body somewhere, even if they didn't get one sent to them. Perhaps I'm the same.

killwhitey 10y ago

Mine starts with 'ab' and is ~7200 on the list