4 ms·

I already did this. I'm tempted to set up a utility page where you enter your email and the utility just tells you if it was in the DB, but I don't know how leg

by cheald 16y ago

I already did this. I'm tempted to set up a utility page where you enter your email and the utility just tells you if it was in the DB, but I don't know how legal that would be. Checking the data for personal defensive purposes is arguably defensible - setting up a tool based on that data (even benign) is likely less so.

iregdtoreply 16y ago
Please do. I don't want to download the torrent and I don't know if I have ever commented on Gawker but there is a slim chance I might have.
ra 16y ago
What about emailing everyone in the DB?
- cheald 16y ago
  "Unsolicited scary email from some guy that got my email from a hacker" sounds like it would only be slightly less legally dangerous than just straight up forcing hashes and posting them.
  - ra 16y ago
    Ha. True
  - jacquesm 16y ago
    I don't know about that. Personally if someone would mail me warning me some site that I am a member of has been compromised I would thank the guy. Gawker probably will not see it that way, but since these email addresses are going to be spammed to death anyway I would think that's a minor issue.
    - cheald 16y ago
      You are likely far more savvy than the average recipient of an email on that list, too. :)
evandavid 16y ago
For people who can't remember if they ever signed up: Go to gawker.com and use the 'forgot my password' utility. It's under login > forgot my password. Enter your email address in the field provided. It will tell you straight away "That email address is not in our records. Please try again." I can't think of any reason this would be incorrect based on the recent events. Of course, this doesn't tell you whether your password is vulnerable, just whether you have an account.
CWuestefeld 16y ago
Apparently somebody thinks they're a "white knight" I just got an email from "The Team at Hint" (teamhint at hint dot io). The text is: Hi there, Hint wanted to let you know that your email address and password that you used to signup for Gawker (or one of its sites) were hacked. Forbes' coverage is here In situations like this, time is of the essence, which is why we were surprised & shocked to find that Gawker Media hadn't taken the initiative to notify you of this privacy breach immediately. We HIGHLY recommend you change all of your online passwords as a precaution. -The Team at Hint (This is a one time email) I'm not sure how ethical this is.
- bmastenbrook 16y ago
  I can't see how it's unethical, unless even looking at the data is unethical, and you'll have to convince me of that. I'd be more concerned about the ramifications than the ethics. The least bad thing that could happen here is winding up on some big ISP's blacklist because enough of their users marked this unsolicited mail as spam. Once that happens, good luck communicating with your customers. I'm sure you can imagine the worst that could happen. Courtrooms are not happy fun places.
  - CWuestefeld 16y ago
    Perhaps you're right (I did say "I'm not sure"). But it did seem a bit ... off ... to me.
  - deleted 16y ago
    [deleted]
  - gkelly 16y ago
    I found this same email in my gmail spam today.
  - henriwatson 16y ago
    The message is lined with tracking URLs. http://identityvector.com/~phil/2010/12/how-not-to-capitalize-on-compromise/ http://identityvector.com/~phil/2010/12/how-not-to-capitaliz...

by cheald 16y ago

iregdtoreply 16y ago

Please do. I don't want to download the torrent and I don't know if I have ever commented on Gawker but there is a slim chance I might have.

ra 16y ago

What about emailing everyone in the DB?

cheald 16y ago
"Unsolicited scary email from some guy that got my email from a hacker" sounds like it would only be slightly less legally dangerous than just straight up forcing hashes and posting them.
- ra 16y ago
  Ha. True
- jacquesm 16y ago
  I don't know about that. Personally if someone would mail me warning me some site that I am a member of has been compromised I would thank the guy. Gawker probably will not see it that way, but since these email addresses are going to be spammed to death anyway I would think that's a minor issue.
  - cheald 16y ago
    You are likely far more savvy than the average recipient of an email on that list, too. :)

evandavid 16y ago

For people who can't remember if they ever signed up: Go to gawker.com and use the 'forgot my password' utility. It's under login > forgot my password. Enter your email address in the field provided. It will tell you straight away "That email address is not in our records. Please try again." I can't think of any reason this would be incorrect based on the recent events. Of course, this doesn't tell you whether your password is vulnerable, just whether you have an account.

CWuestefeld 16y ago

Apparently somebody thinks they're a "white knight" I just got an email from "The Team at Hint" (teamhint at hint dot io). The text is: Hi there, Hint wanted to let you know that your email address and password that you used to signup for Gawker (or one of its sites) were hacked. Forbes' coverage is here In situations like this, time is of the essence, which is why we were surprised & shocked to find that Gawker Media hadn't taken the initiative to notify you of this privacy breach immediately. We HIGHLY recommend you change all of your online passwords as a precaution. -The Team at Hint (This is a one time email) I'm not sure how ethical this is.

bmastenbrook 16y ago
I can't see how it's unethical, unless even looking at the data is unethical, and you'll have to convince me of that. I'd be more concerned about the ramifications than the ethics. The least bad thing that could happen here is winding up on some big ISP's blacklist because enough of their users marked this unsolicited mail as spam. Once that happens, good luck communicating with your customers. I'm sure you can imagine the worst that could happen. Courtrooms are not happy fun places.
- CWuestefeld 16y ago
  Perhaps you're right (I did say "I'm not sure"). But it did seem a bit ... off ... to me.
- deleted 16y ago
  [deleted]
- gkelly 16y ago
  I found this same email in my gmail spam today.
- henriwatson 16y ago
  The message is lined with tracking URLs. http://identityvector.com/~phil/2010/12/how-not-to-capitalize-on-compromise/ http://identityvector.com/~phil/2010/12/how-not-to-capitaliz...