6 ms·

Head of Let's Encrypt here. Our automated mail system had a bug that accidentally exposed about 1.9% of subscriber email addresses to the same 1.9% of recipient

by jaas 10y ago

Head of Let's Encrypt here. Our automated mail system had a bug that accidentally exposed about 1.9% of subscriber email addresses to the same 1.9% of recipients. Our sincerest apologies for this mistake. We will be doing a thorough postmortem to determine exactly how this happened and how we can prevent something like this from happening again. There is a preliminary report on the issue here: https://community.letsencrypt.org/t/email-address-disclosures-preliminary-report-june-11-2016/ https://community.letsencrypt.org/t/email-address-disclosure...

tomjen3 10y ago
What do you need email for, anyway? Not giving you one makes it pretty easy not to leak it.
- technion 10y ago
  They send reminder emails when certificates are due to expire.
- creshal 10y ago
  Reminders/alerts of certificate expiration, for a start.
- pfg 10y ago
  FWIW providing an email address is optional.
DanBC 10y ago
How big do you estimate your fine would have been if you were operating in the EU?
- dave2000 10y ago
  For sharing a few email addresses? $0 I'd imagine. It's not like its anything important like credentials for shopping/banking or other details which could be used in identify theft. Worst case scenario; google's spam filters have to work a little harder. You'd not even notice. Yes, some people have chosen to run their own mail servers for some reason and those people might conceivably get a bit more spam for a while.
  - _9MOTHER9HORSE 10y ago
    > Yes, some people have chosen to run their own mail servers for some reason and those people might conceivably get a bit more spam for a while. Once your email is out there, there's no going back. Email addresses are personally identifiable information, and revealing a relationship between a business and a person is potentially very dangerous. For example: http://www.bbc.co.uk/news/technology-36247186 http://www.bbc.co.uk/news/technology-36247186
    - cm2187 10y ago
      You guys should all switch to disposable email addresses. It solves so many problems. If your address is leaked like that, no big deal, you just delete that alias. If a password is leaked along, again having website specific emails will make it very difficult to correlate your credentials with another website. If you start receiving spam on that address you just delete it. And so it ceases to be personally identifiable information.
      - DanBC 10y ago
        Should I use a disposable name and a disposable address when I buy physical goods from an online retailer?
        cm2187 10y ago
        I actually start to think you should, without joking. At least the name. If you look at the past 5 years, there is almost not a single major website that hasn't been hacked and hasn't leaked personal data. Not only do I see no sign of improvement, but it is rather accelerating. Leaking information on 30m+ people is now becoming common and barely makes the news outside of a few specialized websites like HN. If you have a better alternative than feeding garbage data to websites who want to collect data they won't need (why would an online retailer give a shit that they are shipping a product to someone called Mr X rather than Mr Y?), I want to hear it.
        dave2000 10y ago
- pfg 10y ago
  In case you're referring to the General Data Protection Regulation, it does not apply until May 2018. The penalty that would be applied would probably be this one, given that the number of prior offenses, the gravity and duration of the offense, the number of affected users and the damage caused, etc. need to be taken into account: > Each supervisory authority shall have all of the following corrective powers: > [...] > (b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation; (IANAL)
  - _9MOTHER9HORSE 10y ago
    There are already similar laws in the UK and other countries. See this recent example, where a sexual health centre accidentally leaked a list of 800 people who had attended HIV clinics. They ended up with a £180,000 fine: http://www.bbc.co.uk/news/technology-36247186 http://www.bbc.co.uk/news/technology-36247186
    - pfg 10y ago
      Good point and very similar case (though in an entirely different category of "damage caused", plus there seemed to be a prior offense).
    - corin_ 10y ago
      Most people would consider their possibly/definitely having HIV to be a more personal piece of information than their email address. If I'd been affected by this Let's Encrypt email thing I frankly wouldn't care, other than to question why it happened. (Just speaking for myself, I'm sure some people would care.) But if I was data in a leak revealing a personal serious medical issue, I absolutely would care.
    - M2Ys4U 10y ago
      Data protection is already regulated by the EU (only by means of a Directive rather than a Regulation) so the same principles apply across the EU/EEA, if not the exact rules.
- smartbit 10y ago
  Good to notice that the new EU data protection regulation already has influence on the discourse even though it shall apply from May 25, 2018. And more importantly, even though Letsencrypt is a US based organization it applies directly or indirectly. For those interested, I can highly recommend the documentary Democracy: Im Rausch der Daten (2015) [0]. For 9 month the documentary follows MEP rapporteur Jan Philipp Albrecht and his policy advisor Ralf Bendrath [1] (hacked a C64 in his youth, frequent attendee at C3) and gave a rare inside in the negotiation & process in Brussels. They even recorded the final negotiations in the backrooms and for those knowledgeable on the topic it is very interesting to see how some of the deals where made. After the screening at IDFA the director said he wasn't onset to make a documentary on the EU data protection reform and that Jan Phillip's rapporteur topic was chosen as an example EU process. Regretfully this documentary isn't exemplary for the EU process because most of the time the lobbyists of the large corporations have a far larger influence. The documentary clearly shows that the final text has been the result of the persistence & integrity of the the 3 main characters Albrecht, Bendrath and Redding. And as we're experience now, this has great influence on data protection for more than only Europe. [0] http://www.democracy-film.de http://www.democracy-film.de http://www.imdb.com/title/tt5053042/ http://www.imdb.com/title/tt5053042/ [1] http://www.bfna.org/person/ralpf-bendrath http://www.bfna.org/person/ralpf-bendrath
dang 10y ago
We've changed the URL to that from https://twitter.com/aaronraimist/status/741456355693760513 https://twitter.com/aaronraimist/status/741456355693760513 (and the title from "Let's Encrypt is sending out a list of all their users' email addresses").

by jaas 10y ago

tomjen3 10y ago

What do you need email for, anyway? Not giving you one makes it pretty easy not to leak it.

technion 10y ago
They send reminder emails when certificates are due to expire.
creshal 10y ago
Reminders/alerts of certificate expiration, for a start.
pfg 10y ago
FWIW providing an email address is optional.

DanBC 10y ago

How big do you estimate your fine would have been if you were operating in the EU?

dave2000 10y ago
For sharing a few email addresses? $0 I'd imagine. It's not like its anything important like credentials for shopping/banking or other details which could be used in identify theft. Worst case scenario; google's spam filters have to work a little harder. You'd not even notice. Yes, some people have chosen to run their own mail servers for some reason and those people might conceivably get a bit more spam for a while.
- _9MOTHER9HORSE 10y ago
  > Yes, some people have chosen to run their own mail servers for some reason and those people might conceivably get a bit more spam for a while. Once your email is out there, there's no going back. Email addresses are personally identifiable information, and revealing a relationship between a business and a person is potentially very dangerous. For example: http://www.bbc.co.uk/news/technology-36247186 http://www.bbc.co.uk/news/technology-36247186
  - cm2187 10y ago
    You guys should all switch to disposable email addresses. It solves so many problems. If your address is leaked like that, no big deal, you just delete that alias. If a password is leaked along, again having website specific emails will make it very difficult to correlate your credentials with another website. If you start receiving spam on that address you just delete it. And so it ceases to be personally identifiable information.
    - DanBC 10y ago
      Should I use a disposable name and a disposable address when I buy physical goods from an online retailer?
      - cm2187 10y ago
        I actually start to think you should, without joking. At least the name. If you look at the past 5 years, there is almost not a single major website that hasn't been hacked and hasn't leaked personal data. Not only do I see no sign of improvement, but it is rather accelerating. Leaking information on 30m+ people is now becoming common and barely makes the news outside of a few specialized websites like HN. If you have a better alternative than feeding garbage data to websites who want to collect data they won't need (why would an online retailer give a shit that they are shipping a product to someone called Mr X rather than Mr Y?), I want to hear it.
      - dave2000 10y ago
pfg 10y ago
In case you're referring to the General Data Protection Regulation, it does not apply until May 2018. The penalty that would be applied would probably be this one, given that the number of prior offenses, the gravity and duration of the offense, the number of affected users and the damage caused, etc. need to be taken into account: > Each supervisory authority shall have all of the following corrective powers: > [...] > (b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation; (IANAL)
- _9MOTHER9HORSE 10y ago
  There are already similar laws in the UK and other countries. See this recent example, where a sexual health centre accidentally leaked a list of 800 people who had attended HIV clinics. They ended up with a £180,000 fine: http://www.bbc.co.uk/news/technology-36247186 http://www.bbc.co.uk/news/technology-36247186
  - pfg 10y ago
    Good point and very similar case (though in an entirely different category of "damage caused", plus there seemed to be a prior offense).
  - corin_ 10y ago
    Most people would consider their possibly/definitely having HIV to be a more personal piece of information than their email address. If I'd been affected by this Let's Encrypt email thing I frankly wouldn't care, other than to question why it happened. (Just speaking for myself, I'm sure some people would care.) But if I was data in a leak revealing a personal serious medical issue, I absolutely would care.
  - M2Ys4U 10y ago
    Data protection is already regulated by the EU (only by means of a Directive rather than a Regulation) so the same principles apply across the EU/EEA, if not the exact rules.
smartbit 10y ago
Good to notice that the new EU data protection regulation already has influence on the discourse even though it shall apply from May 25, 2018. And more importantly, even though Letsencrypt is a US based organization it applies directly or indirectly. For those interested, I can highly recommend the documentary Democracy: Im Rausch der Daten (2015) [0]. For 9 month the documentary follows MEP rapporteur Jan Philipp Albrecht and his policy advisor Ralf Bendrath [1] (hacked a C64 in his youth, frequent attendee at C3) and gave a rare inside in the negotiation & process in Brussels. They even recorded the final negotiations in the backrooms and for those knowledgeable on the topic it is very interesting to see how some of the deals where made. After the screening at IDFA the director said he wasn't onset to make a documentary on the EU data protection reform and that Jan Phillip's rapporteur topic was chosen as an example EU process. Regretfully this documentary isn't exemplary for the EU process because most of the time the lobbyists of the large corporations have a far larger influence. The documentary clearly shows that the final text has been the result of the persistence & integrity of the the 3 main characters Albrecht, Bendrath and Redding. And as we're experience now, this has great influence on data protection for more than only Europe. [0] http://www.democracy-film.de http://www.democracy-film.de http://www.imdb.com/title/tt5053042/ http://www.imdb.com/title/tt5053042/ [1] http://www.bfna.org/person/ralpf-bendrath http://www.bfna.org/person/ralpf-bendrath

dang 10y ago

We've changed the URL to that from https://twitter.com/aaronraimist/status/741456355693760513 https://twitter.com/aaronraimist/status/741456355693760513 (and the title from "Let's Encrypt is sending out a list of all their users' email addresses").