4 ms·
Don't login to reference.me
Funny story.
A web site, you login with google oauth, and after that send invitations to all of your contacts. Including that email accounts that are reserved for monitoring and alert systems.
See how my college receive and sms from and alert system and asking to ack the alert "you have and invitation from reference.me" was fun, but not serious.
So for your good. Don't even enter this spammers site.
And if you do, remember to revoke access from your oauth provider.
- alpb 15y agoWhy don't you report scam to oauth providers?
- andybak 15y agoAny specific suggestions as to what reporting method to use? Is there anything in place for this kind of abuse? Has anyone reported anything like this before and can comment on the efficacy of the complaint?
- cientifico 15y agoI will be very happy if you point me to the place or the way to report that. I was looking in my profile, and in google help.
- taw 15y agoDon't use any "Sign up with ..." ever, except maybe OpenID which is fairly safe.
- alanbyrne 15y agoThat's really disappointing. It's hard enough trying to get people to trust your app without jokers like this ruining it for the rest of us. I agree with alpb, report it!
- dweisser 15y agoYeah - whew. If you guys are interested in reference websites, check out solidreference.com.
- andybak 15y agoHere's a clue: "A third party service is requesting permission to access your Google Account." That's full access you're granting there - not just oAuth login. It's pretty hard to spot that though. Not sure if I would have.
- cientifico 15y agoYeah. I know is totally my fault. But that site seems like a site to trust. And yes. That is a huge mistake.
- hdragomir 15y agothe thing that stuck out was their request to access email, not just contacts. That was a bit odd so I didn't grant access.
- rbanffy 15y agoIt's worth setting up a fake/honeypot account to play with services like this.
- deleted 15y ago[deleted]
- freshhawk 15y agoWell you weren't the only one at least. I got a crapload of spam from other people signing in this morning and yesterday. What the hell was their plan here? Unless this was some project to show people not to trust these types of sites with oauth permissions then it was a catastrophic failure wasn't it? I'd never heard of them and now all I've heard, from multiple people, is to never sign in to their site because they're horrible spammers. The tone has, 100% percent of the time, been one where they wanted to at least spit in someone from reference.me's face, if not punch them. Unless they've figured out a way to monetize user hatred ...
- freshhawk 15y agoYour post got disappeared. So mixtent (the guys behind reference.me) or some fans decided to all flag you? Or was it admin action? For whatever reason, all traces of stories about startups behaving badly have a tendency to disappear from HN these days. As do stories about the dissapearance itself. Really disappointing to someone who likes the HN community.
- nickmolnar2 15y agoIt'd be nice to have an audit trail of admin actions on HN somewhere.
- primitive 15y agoVery happy I spotted this thread! I did wonder what they'd do with so much access to my Google account. Dodged a bullet there I think!