3 ms·
[WAS: If I'm reading the Wired article[1] correctly, the haveibeenpwned.com database of email addresses has itself been leaked?] EDIT: Replies have corrected m
by aaronharnly 8y ago
[WAS: If I'm reading the Wired article[1] correctly, the haveibeenpwned.com database of email addresses has itself been leaked?]
EDIT: Replies have corrected my misunderstanding, thanks! Troy was saying that his own personal email was also in the dataset.
Hunt says some of his own information is included in the Verifications.io exposure. "The main takeaway for me is that this is just another case where someone has my data, and hundreds of millions of other people’s data, and I’ve absolutely no idea how they got it," Hunt says. "I’d never heard of the company until now and I certainly can’t ever recall consenting to their use of my data. Of course, it’s entirely possible that buried in some other service’s terms and conditions it says they’re allowed to pass my data around in this fashion, but that’s not really consistent with my expectations of how my data should be used.""
[1] https://www.wired.com/story/email-marketing-company-809-million-records-exposed-online/ https://www.wired.com/story/email-marketing-company-809-mill...
- ineedasername 8y agoNo, he's saying the leaked database has an entry for him. Not that his own database of leaks has been breached.
- aaronharnly 8y agoAh, got it. Like, Troy is a real person who has his own email address too :)
- triangleman 8y agoNo, he's adding this email dump to his DB. And I don't exactly understand why, I mean is there any evidence that this mongodb was actually harvested? Other than by security researchers.
- outworlder 8y agoThat's not how security works. If someone gains unauthorized access to a system you own, you assume it's compromised and take it down, even if logs don't show anything. If you leave a system unsecured on the internet, assume it has been compromised and take appropriate measures. In this case, it is more likely than not that this guy was not the first to discover the database. In the absence of proof, assume it has been compromised before.
- deleted 8y ago[deleted]