4 ms·

The initial comments here are pretty odd. I think it's the first time I've stepped into a HN thread where people are mad at the hackers because the target compa

The initial comments here are pretty odd. I think it's the first time I've stepped into a HN thread where people are mad at the hackers because the target company decided to hash their passwords in unsalted md5.

techrat 5y ago
And how often you see on HN how people should vet who they do business with... but now are saying they're mad at hackers for going after someone who "happens to host some bad websites and not someone like Youtube instead cause they have [this] video, too!" Epik is notorious for being a safe haven to the most extreme of right wing sites. There's simply no way you could not know what their business model is. Guilt by association might suck, but they still willingly associated.
octopoc 5y ago
Are there are unsalted passwords in the leak though? I haven't downloaded any of it and the description doesn't mention this.
- nemothekid 5y ago
  https://twitter.com/stevanzetti/status/1437482759241469958 https://twitter.com/stevanzetti/status/1437482759241469958
heyitsguay 5y ago
HN, truly a place with a diversity of opinions spanning the entire political spectrum, nonetheless has sadly taken to leaning net-alt-right over the past few years. Anti-anti-fascist sentiment trumps pro-hacker sentiment in this case.
- plandis 5y ago
  I’m pretty left leaning but I don’t think it’s right to leak all of their customers simply because some subset of the domains were used for unsavory purposes. That’s not a fascist ideology, I think people should have their privacy respected and this will harm innocent individuals.
zamadatix 5y ago
Normally the hackers post the leak because they weren't paid off. In this case they just plain doxxed people for harassment purposes (however benevolent the purposes are perceived) and had the gumption to list "harassment and doxing websites" as part of the reasoning. It's not the typical hack scenario. Not that Epik is a great host. It's god awful and used by many horrible sites (but probably mostly clueless and harmless ones by absolute numbers which is part of the problem). Just normally the hackers are aware they are black hat hacking for profit not posting how they are self proclaimed white hat hacking for free.
- nemothekid 5y ago
  Not typical? What makes this hack different from the Sony leak by lulzsec and the other high profile hacks by the various lulz copycats 5 - 10 years ago? The dump is completely reminiscent of 4chan/Anonymous hacktivists as well. I don’t know anything of Epik before this hack, but to me it’s clear that it was only a matter of time for Epik, and people should be mad at Epik. Unsalted md5 in 2021 is just inexcusable at this point and I’m doubtful this kind of hack took any skill at all given the complete lack of security they employed.
  - zamadatix 5y ago
    > What makes this hack different from the Sony leak by lulzsec and the other high profile hacks by the various lulz copycats 5 - 10 years ago? That the first thing that came to mind is a hacking group which disbanded a decade ago is a hint what you're describing is atypical considering these kinds of hacks are constant. Check the incident list on haveibeenpwned for example most of these are self admitted black hatters or criminal gangs, not hacktivist groups. That's not to say there isn't also a lot of meme refencing and lulz involved as well just the hactivism "we're the good guys" isn't typical even when filtering to just the 4chan/Anonymous style hacks. > The dump is completely reminiscent of 4chan/Anonymous hacktivists as well. 4chan/Anonymous weren't normally "hacktivists". E.g. lulzec... did it for the lulz. They didn't do it claiming to be white nights they actually called out white hat hackers as corrupt. They knew what they were doing was wrong they just found it funny - there is no need comment how the hackers are bad when they go around saying they are in the leak. The hackers here explicitly think what they were doing is good hence the extra reaction saying wait, this is certainly not white hat hacking. > I don’t know anything of Epik before this hack, but to me it’s clear that it was only a matter of time for Epik, and people should be mad at Epik. Unsalted md5 in 2021 is just inexcusable at this point and I’m doubtful this kind of hack took any skill at all given the complete lack of security they employed. Largely agreed however it's possible to be angry at 2 parties at the same time and it's typical that every site at the butt end of a hack is found to have bad security (hence the hack) so it's not going to get the same reaction boost for commenting as hackers leaking some of HN's non-fascist members private info out of "altruism".

techrat 5y ago

And how often you see on HN how people should vet who they do business with... but now are saying they're mad at hackers for going after someone who "happens to host some bad websites and not someone like Youtube instead cause they have [this] video, too!" Epik is notorious for being a safe haven to the most extreme of right wing sites. There's simply no way you could not know what their business model is. Guilt by association might suck, but they still willingly associated.

octopoc 5y ago

Are there are unsalted passwords in the leak though? I haven't downloaded any of it and the description doesn't mention this.

nemothekid 5y ago
https://twitter.com/stevanzetti/status/1437482759241469958 https://twitter.com/stevanzetti/status/1437482759241469958

heyitsguay 5y ago

HN, truly a place with a diversity of opinions spanning the entire political spectrum, nonetheless has sadly taken to leaning net-alt-right over the past few years. Anti-anti-fascist sentiment trumps pro-hacker sentiment in this case.

plandis 5y ago
I’m pretty left leaning but I don’t think it’s right to leak all of their customers simply because some subset of the domains were used for unsavory purposes. That’s not a fascist ideology, I think people should have their privacy respected and this will harm innocent individuals.

zamadatix 5y ago

Normally the hackers post the leak because they weren't paid off. In this case they just plain doxxed people for harassment purposes (however benevolent the purposes are perceived) and had the gumption to list "harassment and doxing websites" as part of the reasoning. It's not the typical hack scenario. Not that Epik is a great host. It's god awful and used by many horrible sites (but probably mostly clueless and harmless ones by absolute numbers which is part of the problem). Just normally the hackers are aware they are black hat hacking for profit not posting how they are self proclaimed white hat hacking for free.

nemothekid 5y ago
Not typical? What makes this hack different from the Sony leak by lulzsec and the other high profile hacks by the various lulz copycats 5 - 10 years ago? The dump is completely reminiscent of 4chan/Anonymous hacktivists as well. I don’t know anything of Epik before this hack, but to me it’s clear that it was only a matter of time for Epik, and people should be mad at Epik. Unsalted md5 in 2021 is just inexcusable at this point and I’m doubtful this kind of hack took any skill at all given the complete lack of security they employed.
- zamadatix 5y ago
  > What makes this hack different from the Sony leak by lulzsec and the other high profile hacks by the various lulz copycats 5 - 10 years ago? That the first thing that came to mind is a hacking group which disbanded a decade ago is a hint what you're describing is atypical considering these kinds of hacks are constant. Check the incident list on haveibeenpwned for example most of these are self admitted black hatters or criminal gangs, not hacktivist groups. That's not to say there isn't also a lot of meme refencing and lulz involved as well just the hactivism "we're the good guys" isn't typical even when filtering to just the 4chan/Anonymous style hacks. > The dump is completely reminiscent of 4chan/Anonymous hacktivists as well. 4chan/Anonymous weren't normally "hacktivists". E.g. lulzec... did it for the lulz. They didn't do it claiming to be white nights they actually called out white hat hackers as corrupt. They knew what they were doing was wrong they just found it funny - there is no need comment how the hackers are bad when they go around saying they are in the leak. The hackers here explicitly think what they were doing is good hence the extra reaction saying wait, this is certainly not white hat hacking. > I don’t know anything of Epik before this hack, but to me it’s clear that it was only a matter of time for Epik, and people should be mad at Epik. Unsalted md5 in 2021 is just inexcusable at this point and I’m doubtful this kind of hack took any skill at all given the complete lack of security they employed. Largely agreed however it's possible to be angry at 2 parties at the same time and it's typical that every site at the butt end of a hack is found to have bad security (hence the hack) so it's not going to get the same reaction boost for commenting as hackers leaking some of HN's non-fascist members private info out of "altruism".