5 ms·

Imgur Data Breach: Personal details of 1.7M user accounts stolen

33 points by sus_007 9y ago

PeachPlum 9y ago
If they don't know about how, it means it could be ongoing. But they are only informing users from 2014. This is what happens when you use a hashing algorithm to encrypt things.
moepstar 9y ago
With a breach every other week (or even more than one a week) one's getting pretty indifferent to yet another one... Use a password manager and consider everything you entered in a form somewhere to be public knowledge... That being said, i want companies that have been breached being audited - and if proven careless, sued for damages.
pksadiq 9y ago
When CDN like cloudflare are used (as in HN), won't cloudflare get the text I send? If so, doesn't that mean that cloudflare can know many of my passwords?
- londons_explore 9y ago
  Cloudflare, and Amazon AWS for many sites, and your browser's data compression proxy (if you have that enabled). All of those companies have hundreds of people who could access the data. And any misconfiguration or bug could open a hole for the whole world to see the data...
fwn 9y ago
> "Imgur has never asked for real names, addresses, phone numbers, or other personally-identifying information (“PII”), so the information that was compromised did NOT include such PII." This sounds somewhat cheeky at first, but is in fact the greatest prophylaxis against breachs. Do not store & collect data you don't absolutely need.
- chmars 9y ago
  Most e-mail addresses are actually personally-identifying information (according to European data privacy laws and in also in, ehmmm, reality).
- jpalomaki 9y ago
  For those users who have opted or email notifications, you could store only bcypted email.
ryanlol 9y ago
Imgur knew of this breach, just didn’t bother to announce/investigate until an external party sent them their user db.
ochronus 9y ago
How about social sign-in data like tokens? Was that stolen as well?

5 ms·

Imgur Data Breach: Personal details of 1.7M user accounts stolen

33 points by sus_007 9y ago

PeachPlum 9y ago
If they don't know about how, it means it could be ongoing. But they are only informing users from 2014. This is what happens when you use a hashing algorithm to encrypt things.
moepstar 9y ago
With a breach every other week (or even more than one a week) one's getting pretty indifferent to yet another one... Use a password manager and consider everything you entered in a form somewhere to be public knowledge... That being said, i want companies that have been breached being audited - and if proven careless, sued for damages.
pksadiq 9y ago
When CDN like cloudflare are used (as in HN), won't cloudflare get the text I send? If so, doesn't that mean that cloudflare can know many of my passwords?
- londons_explore 9y ago
  Cloudflare, and Amazon AWS for many sites, and your browser's data compression proxy (if you have that enabled). All of those companies have hundreds of people who could access the data. And any misconfiguration or bug could open a hole for the whole world to see the data...
fwn 9y ago
> "Imgur has never asked for real names, addresses, phone numbers, or other personally-identifying information (“PII”), so the information that was compromised did NOT include such PII." This sounds somewhat cheeky at first, but is in fact the greatest prophylaxis against breachs. Do not store & collect data you don't absolutely need.
- chmars 9y ago
  Most e-mail addresses are actually personally-identifying information (according to European data privacy laws and in also in, ehmmm, reality).
- jpalomaki 9y ago
  For those users who have opted or email notifications, you could store only bcypted email.
ryanlol 9y ago
Imgur knew of this breach, just didn’t bother to announce/investigate until an external party sent them their user db.
ochronus 9y ago
How about social sign-in data like tokens? Was that stolen as well?