3 ms·

This submitter has basically no history on this site. Smells like a honeypot to me.

exolymph 9y ago
You'd have to be a moron to use a password that already you use anywhere else. Then again, people are generally morons. (Or, more charitably, they know very little about technology and opsec. Granted, that doesn't seem to be the Hacker News target audience.)
- jonas21 9y ago
  But that's the whole point of the site. If I enter a randomly-generated password, how's it supposed to match me with anybody?
  - exolymph 9y ago
    You could use a password that you feel represents you despite being newly conceived.
- sandov 9y ago
  You'd have to be a moron to use your password AND give some other information that can be traced back to you or your accounts by the creator, passwords by themselves are practically useless.
  - jstanley 9y ago
    I think you'd have to be a moron to give your password even if you don't knowingly give some information that can be traced back to you. Even if nothing at all traces it back to you, it would be easy to add every received password to a dictionary for later consultation. But besides that, the data can be linked to you if you ever knowingly give any identifying data to another website that the attacker here has control over (or, at least, can observe). If he sets a cookie, or remembers your ip address, or your browser fingerprint, there's every chance that he might later be able to find out your real email address. Do not give your real passwords to this site.
jstanley 9y ago
His only previous submission was https://web.archive.org/web/20150203155420/http://loseyourbitcoins.com/ https://web.archive.org/web/20150203155420/http://loseyourbi... which seems to be a cheap (albeit honest) trick to get money out of people, so it's quite plausible that this project is simply a cheap trick to get passwords out of people. Hopefully it comes with a followup blog post with some interesting analysis, although I'm not sure what the overlap is between "interesting" and "ethical" with a data set like this. Hopefully it does not come with a followup blog post from somebody else who finds all the data up for sale on a darknet market...

You'd have to be a moron to use a password that already you use anywhere else. Then again, people are generally morons. (Or, more charitably, they know very little about technology and opsec. Granted, that doesn't seem to be the Hacker News target audience.)

jonas21 9y ago
But that's the whole point of the site. If I enter a randomly-generated password, how's it supposed to match me with anybody?
- exolymph 9y ago
  You could use a password that you feel represents you despite being newly conceived.
sandov 9y ago
You'd have to be a moron to use your password AND give some other information that can be traced back to you or your accounts by the creator, passwords by themselves are practically useless.
- jstanley 9y ago
  I think you'd have to be a moron to give your password even if you don't knowingly give some information that can be traced back to you. Even if nothing at all traces it back to you, it would be easy to add every received password to a dictionary for later consultation. But besides that, the data can be linked to you if you ever knowingly give any identifying data to another website that the attacker here has control over (or, at least, can observe). If he sets a cookie, or remembers your ip address, or your browser fingerprint, there's every chance that he might later be able to find out your real email address. Do not give your real passwords to this site.

jstanley 9y ago

His only previous submission was https://web.archive.org/web/20150203155420/http://loseyourbitcoins.com/ https://web.archive.org/web/20150203155420/http://loseyourbi... which seems to be a cheap (albeit honest) trick to get money out of people, so it's quite plausible that this project is simply a cheap trick to get passwords out of people. Hopefully it comes with a followup blog post with some interesting analysis, although I'm not sure what the overlap is between "interesting" and "ethical" with a data set like this. Hopefully it does not come with a followup blog post from somebody else who finds all the data up for sale on a darknet market...