10 ms·
8M GitHub profiles were leaked from GeekedIn's MongoDB
- toyg 10y agoI've long subscribed to HIBP, so I got the relevant email about this today; however, when I check on the site, I don't get the "raw geekedin data" button in Safari nor in Firefox. What's up? EDIT: I basically re-subscribed, and once I re-verified the address, I got the button.
- thejosh 10y agoSo it's just public info you can already get from Github?
- taotao670 10y agoYeah not sure if this is dangerous in any way? Maybe this will allow me to get more stars on my Github profile.
- prplhaz4 10y agoWell, kinda, but based on the examples given, the data also includes assessments and assumptions about you presumably based on the aggregated information that is available. They appear to be building recruiting profiles of github users based on their public GH profile and commit info.
- yeukhon 10y agoBut you just said they are all public data, it just happens someone spent the time to build a profile more "digestible". So in the end, really, this is public data.
- w8rbt 10y agoI looked at my data. It's all public data anyway. I'm not surprised or concerned. Perhaps I'm missing something obvious?
- chadscira 10y agoDoesn't github already make majority of this data public? With the exception of emails... Previously they used gravatar hashes which allowed email brute forcing (since removed). Then they also were not omitting emails from commit messages. https://cloud.google.com/bigquery/public-data/github https://cloud.google.com/bigquery/public-data/github
- amorphid 10y agoI used a recruiting tool about 2 years ago that crawled GitHub & other sources, building a profile which including email addresses. One developer's profile didn't have an email address, which I thought was odd, as the email would likely be in a git repo. Sure enough, it was. As I write this, it occurs to me that there's not a foolproof way to verify an email in the developer's GitHub repos belongs to the same developer. GitHub user janedoe may or may not be the same person that made a commit w/ the email address jane@doe.com.
- chadscira 10y agoThe email verification was easy when they provided gravatar ids, which used to just be MD5(email).
- a3n 10y agoIt's like DMV records being public. You used to have to go there, or phone, and you were only looking for information about a specific person. But if it's available on the internet, it becomes a different thing entirely. Rather than being track-downable for specific purposes, you become harvestable for mass purposes. Merely being known is sometimes the first step in being victimized, and these kinds of things make being known easier and more frequent.
- username223 10y ago> You used to have to go there, or phone, and you were only looking for information about a specific person. Exactly. If $INTERNET_DATA_HARVESTER had to pay someone to watch whenever it wanted to see what I did on the internet, it would cost them a lot of money, so they would only watch if they had a reasonable suspicion of profit. Even at starvation wages of $2/day, that's $700/yr/person, which would bankrupt the major data harvesters. Even if Facebook only paid each starving person to stumble over to the DMV one day a year, it would cost them $42 billion to monitor their users.
- wyldfire 10y agoBoy, I gotta say I was really nervous when I saw "Have I been pwned" in my inbox. Took a while to convince myself that it's just my public-facing Github profile.
- r3bl 10y agoMy email address has already been breached on three different services. The previous two were sites that I've used once and never again, this one I obviously never heard of until today, when the breach happened. Even though I use a password manager and unique passwords, I still get the shills whenever I see an email from the HIBP domain. It's just something that makes me feel uncomfortable, even though I know that the breach is specific to a site that I have never used frequently and doesn't affect any of my other profiles.
- midwestcode 10y agoNo kidding, definitely an "oh shit" email.
- 1qaz2wsx3edc 10y agoInit protocol 0: wipe everything, airgap with tails
- 10y ago
- r3bl 10y agoI'm one of the affected users. My initial reaction was that I had absolutely no idea that this site even existed. While this is publicly facing data, it might explain some situations that I experience, such as people sending me generic recruitment emails to my old email address (the one leaked here, that hasn't been on my GitHub page for months now) filled with the name of the GitHub repository with the most stars and telling me how they liked my code in that repository (even though the most popular one on my profile is not software-related at all). Mini ask HN to those whose email address is public on GitHub: How frequently do you get these kinds of recruitment emails?
- proaralyst 10y agoFairly regularly. On the address leaked too.
- perryh2 10y agoIf you haven't already, change the email to some "noreply" address in the commits you author and add that to your GitHub profile so they can be attributed to you. I've built a similar scraper for recruiters as a source for talent leads when I used to work at a big company.
- cyphar 10y agoI don't see why people have such a huge issue with email being in public commits. I maintain a large project (runC) and sign all of my commit with my company email -- which makes noreply.github.whatever not a viable option. Not to mention that sometimes I get useful emails rather than recruiter spam, and I got my current job from using my email in commits (my employer approached me). But for those who care, the best solution would be if GitHub didn't show emails in their webui or APIs -- you have to clone the repo to get the information. That makes it prohibitively expensive to scrape every repo on GitHub (so you'd have to narrow down what repos you're interested in).
- Kpourdeilami 10y agoI once cloned a .NET repo to my Github and ever since I keep getting emails from recruiters about .NET job opportunities despite not having .NET (and things related to .NET) listed as one of my skills anywhere else
- daw___ 10y agoFrom GeekedIn's announcement [0]: It is a site that crawls open-source code hosting sites (e.g. github and bitbucket) and creates profiles of open-source projects and open-source developers. Those profiles include things like technologies used by a developer on open source projects (e.g. Scala/Java, .NET, Clojure, Python, etc), libraries and frameworks (e.g. Hibernate, Spring, JQuery, bootstraps, etc.), on many cases locations of the developer, and even when a developer used a particular technology (for Open Source projects) [0] "I'm creating www.geekedin.net" https://www.linkedin.com/pulse/im-creating-wwwgeekedinnet-ernesto-reinaldo-barreiro https://www.linkedin.com/pulse/im-creating-wwwgeekedinnet-er...
- captn3m0 10y agoFirst breach for my current email. There goes my clean track-record, although I guess this one doesn't count that heavily. _Edit_: Just checked my leaked info. Either Troy's service or geekedin didn't scrape the data properly, because it shows up my very tiny secondary account I'd made long back for some github specific testing (that required a second account)
- danielpatrick 10y agoTwo days ago I received an email from a recruiter at http://sourced.tech/ http://sourced.tech/ mentioning they had analyzed my open source contributions and they had a position that matched me. It looks like source{d} brags about scraping personal data from sites for recruitment purposes. The problem is the email they used is not publicly facing in my Github account, but it _is_ the login email that I use for Github. I never got the "Have I Been Pwned" email, but this is very concerning to me, I keep this email very private. Coincidence?
- pkill17 10y agoAre you sure none of the commits on any of your repos accidentally have the author email as the private one you login with?
- deleted 10y ago[deleted]
- throwwwwwwwwww 10y agoI was about to say the same thing. For example if you go to someones GitHub profile and they have a public e-mail listed but you then go their repositories, filter by "source" (repos created by them, not forks) and you go to the oldest one they have of that kind, git clone that and then git shortlog -s -e You might find that they were using their school e-mail back then for example. Also if you clone all their repositories and everything else they have contributed to you might find an occasional commit in which they accidentally used for example the e-mail they have at work.
- dom0 10y agoYou can just retrieve the Git patch directly from the commit page (add .patch to the URL), which has all the metadata of the commit, including author info.
- toqueteos 10y agoI worked at sourced.tech Back then we crawled all public github repos and took a look at all the commits so any email you've used for making commits with git and pushed to GitHub is public. The analysis is somewhat legit. The email is ofc automated but it was quite high quality. I left on March this year so things may have changed an awful lot. EDIT: By high quality I mean they give you all the possible details of the offer. Again, this might have changed. If you are unhappy with them feel free to rant on Twitter mentioning them and they'll get back to you very quickly.
- bbcbasic 10y agoYou can find some github profiles with old information in the waybackmachine. Not troyhunt (unfortunately as that would have been nice to show off my point!) but I found some others.
- specialp 10y agohttps://api.github.com/users/1 https://api.github.com/users/1 This isn't hard to do. All they did was iterate the user ids from 1-n. It is the Rails way to assign ids incrementally.
- orf 10y ago> It is the Rails way to assign ids incrementally. Well... their databases way. It's not 'the rails way'.
- kristianp 10y agoIt's also the Rails way unless things have changed since I last used Rails.
- diziet 10y agoThat's incorrect, you're looking at user "1" which is here: https://github.com/1 https://github.com/1 The "created_at": "2012-06-07T06:10:07Z" also gives it away. i.e., my profile is here: https://api.github.com/users/diziet https://api.github.com/users/diziet Also, numerical profile ids in URLs are more of a SQL thing rather than rails.
- coltonv 10y agoThis isn't correct. The users/1 doesn't take you to the user with id=1, it takes you to the user with username=1, which is very different. For example you can see my github profile on this api by doing https://api.github.com/users/cvoege https://api.github.com/users/cvoege The link you gave there is to the person with the username 1. Second of all you can't see my email since it's not publicly available on github, and most people's aren't as far as I know. Third of all incremental integer ids isn't the "rails way", this would be decided by the database and has nothing to do really with rails or whatever framework you use.
- cyphar 10y agoI just found out that GitHub actually publicly publishes everything I've done on their site. That's a bit creepy. https://api.github.com/users/cyphar/events https://api.github.com/users/cyphar/events
- sriehl 10y agoI was wondering why I started getting recruitment emails. I'm glad I changed my email address on github recently.
- eriknstr 10y ago-----BEGIN PGP MESSAGE----- Comment: https://keybase.io/download Version: Keybase Go 1.0.18 (linux) wcBMA2voNfUjDXxxAQgADmSutt+77JUGVIG2s7cYL4C1H2KIdvQ+PzVHVwsVAISD na5ZVoxHCL6HA3oSGmQ3lkdWcAQbXNuvkPmt9kftBcFdgozjaxVGdIzj61hoUjXg S9IpUTlVIH3ndU7T00OEYBJ4rqF0RmPx2UpwihEP3GW3GuBhpdM4qnN5JPPW0Dn8 juDW8SKw4BbTKVSjrNMXhJibanYYSbLxH9Upz82RdfwL0OR/BMC7TdSd2ArciHwV EnNQxyp+eMIVzqn3OOgTm1KKVfgs9AHZEpd1qW8Aj4l55DJnyw6o11AdtzgF75yB IC7CMSVA5V/77pfPksc8PDK+GgNKlgwveSSLjP1QesHBTAPeBKJkXpGdGQEQAC5d IWI143TKANbHDu2T11t0ZMEsCBxIo8HvP/8t6QyFy8QnUN5u9lQhri/dYoNKyI7r cJK3IdTK50pjlCfvZ2VwwIEO6NBFPNaCP0GmXjTIJDQwxEeT552iqL74AfKjBsCd tXzZFHagwD+A0is5U36x8Y4SC60jlWG1GE085usAs1om8ylpq9lbfulJjmTJBIrL tTQianUHwKtmAmKbRwi8jBYE28JG1lOZWzfynG6kX3lZs/vDKG6IXwTtivMe8Grv tphdWVM4eCpJhz6JrFX08iIavcnde6RNBe6zrFk4Qmu+ebWOYuI6QLZ+cFgXSe7w RkyWxM8RJev5HBZeWVAhzAk0n9LTvQtEH/KkUFE4guglyasJfbcVccsooN8I/bkc 1R9D9TMx+35C+J0luxvFuHaZlsAd7VPteQqAjKbj4quo0/x3Mf+VRMSG4BO7YMN7 54vCRcTyl5pqynrYV87QfiuVUcwJSteMH42r0fGvBd+SDL1BSjsTx/TIB1gtfJK3 L7W1ntn+brgV8jNQ34KnD4n1BdlvIcPpnQbc5ZDmCSeku4DL7iMJotX5/V8x/tgd r9V0AnrhYBjR1MlLNh70wpk0gewKMUj3VD/dwngDdmGFfM6yzZjKaYGQZ8dp5Uae Ja7sn5o9QphcN8CV4C7NWGX0KYeIJzJh/fV/CDXF0uAB5AaqZ1QbsymdwQnobnyo W/jh1tjhjADj/TQdfTrEiWPi4/hiwuDd4FngqOEe/OAS4tVW0+ngMOXEqrw72+1I R6B/GwnDEjzvMS5TyuE+pjzM+roXJ4hlx+C75HCpZTCLmcthIrAU3tHBaj7g5eNY TW+2gM0YYOA54qGUJdXgeeHW3ODU4IfgbeEWgOAG5OkZHtRWixWrexiXA/ubV2zi TLOVrOG61uGfpuG/o+FbQeg2yLKQkqlt6rKZdZyq6pIRvY3BexttFunBzTvoK30b /IptTMRIxU/YB/3A+5nE50HMB+NVDwafo+KZb3345cCHuGHTfOkTqwnj9m1uO5Bt O4I5cngU/r+Y6MwFi5GYvgL4duobW87/6sfuxvTikjCt5djBtfMdUD/73+PPRB1d wOaagz0wZzE/0CbwfkRUwGRQUbiIzasxTMkWw5eFp8HFm/W59Ah5+IJdIAMrHFsW RvkwSVSSzaypNP/jseXUA938f+oT2VCLubdj/YVEaG58eV8I3xR2uLgSEBd7zrJx Jp24c+IIeo7Sp08xtGaBwCGcrX35K4JKvayjyMuJrh9r5LCUVw8LZ7w4CvDUpksU yQ3i0z1XF+EO6wA= =5aeR -----END PGP MESSAGE-----
- wyldfire 10y agoI downvoted you because the point of your message is unclear and useless.
- 10y ago
- algesten 10y agomy leak says I only have 2 years of experience?!?! puleaaze! how do I correct them?
- Ziomislaw 10y agomine says 47 years. I AM NOT THAT OLD ;p
- Symbiote 10y agoIf they're based in Spain, isn't this a clear breach of EU data protection legislation? Is it even possible for the service to comply with the data protection directive? It's necessary to obtain consent before processing personal data, but that's not the case here. https://en.wikipedia.org/wiki/Data_Protection_Directive https://en.wikipedia.org/wiki/Data_Protection_Directive
- a3n 10y agoI just signed up to HIBP because of this. But I'm still nervous about it, because now I'm known by another party, and they know where I've been compromised and with what email. HIBP is probably good people, but they can be breached too. It's why it's taken me this long to convince myself to try it.
- ErikAugust 10y agoThe "data trading scene" referenced by the author. What/where is this? Dark web?
- necessity 10y agoPublic data LEAKED!!!
- SCdF 10y agoInterestingly, I don't have my GH location set, and so their data defaults to ZA, and my location to 28.16256, -23.41612. Weird they couldn't just leave those values blank.
- libeclipse 10y agoA friend of mine's github profile returned a 404 for a while today. I'm thinking it wasn't a coincidence.
- addadandan 10y agoYeah I agree. Full of shit. Seems like a gorilla marketing tactic for have I been pawned. I definitely feel as though i have been pawned now. The data is not hacked and therefore you are legally entitled to expose via your HIPD service. When I mentioned that the IPs were exposed they were taken down in less than a couple of minutes. Yet 18 minutes after you replied saying that you contacted "someone" to take them down. Clever way to get on the front page of hacker news. Right out of the politics of fear playbook :) Have we been pwned?? Yes we have. Traffic whore. "One of the key projects I'm involved in today is Have I been pwned? (HIBP), a free service that aggregates data breaches and helps people establish if they've been impacted by malicious activity on the web. As well as being a useful service for the community, HIBP has given me an avenue to ship code that runs at scale on Microsoft's Azure cloud platform, one of the best ways we have of standing up services on the web today."
- kristianp 10y agoI was a little surprised to see mr Hunt publishing the IPs of the Mongo servers. That's not something he usually does.
- username223 10y agoIt seems like GeekIn is straightforward web-scraping by a greedy creep. This is why I just create a new throwaway account whenever I need to deal with Github in a logged-in way. Thank God for Mailinator.
- Cub3 10y agoGrr, i'm both affected bu this and the recent Donate Blood leak, is there anything I should be doing to increase my security to protect against these kinds of leaks? Or, even protect things like my Bank Accounts, Utility accounts etc. against spear phishing attacks?
- plorntus 10y agohttp://i.imgur.com/fWT8usT.png http://i.imgur.com/fWT8usT.png I really should have abused the github email bug further to do something more fun with scrapers.
- Sephr 10y agoHow is this notable? It's just public data scraped from GitHub. I wouldn't care even if they intentionally redistributed this database to everyone. The more in-depth metrics are also things you can scrape from GitHub. If you aren't comfortable with these metrics being calculated about your public actions, then you probably shouldn't have signed up for a "social coding" site.
- runeks 10y agoI agree. Redistribution of public knowledge can hardly be described as a "leak". I received an email from haveibeenpwned.com about this, but I don't see how this makes sense, given that no information was revealed that users hadn't consented to reveal.
- Halienja 10y agoDemystified the Recruiter spam - "We've analyzed your GitHub contributions". Thanks Troy or else I would have kept wondering about these spams!
- cdevs 10y agoCan geekedin help us hire developers that have some security awareness? Maybe make a site that list those that work for departments that get breached in the future and there will be some accountability for the first time.
- michaelmior 10y agoFor anyone who is not aware, Have I been pwned[0] is a great way to keep tabs on data breaches involving your data. You just give them your email and you'll be notified if it shows up in data dumps from any major breach. [0] https://haveibeenpwned.com/ https://haveibeenpwned.com/