4 ms·

are emails private info?

enasterosophes 3y ago
It may depend on definitions. Where I work, we classify users' emails as "personal" information, and we would consider it a breach if all the emails were leaked.
- hasty_pudding 3y ago
  I can see it being a low tier breach.
Levitating 3y ago
Well as the page states, these were scraped from a public endpoint. So not really
- mgbmtl 3y ago
  What's the endpoint? Why did it provide personal information? Why wasn't it throttled? Many things don't matter at a small scale, but they do at 15M-scale. Trello users are about to get bombarded by phishing attempts and spam.
  - hasty_pudding 3y ago
    Checkmate hackers. I already am bombarded by phishing attempts and spam.
  - Levitating 3y ago
    > Trello users are about to get bombarded by phishing attempts and spam. All of the emails present in this "leak" were taken from other dumps. That's how it's made, they took a list of known emails and tried to link them to a trello account.[1] > What's the endpoint? I think https://developer.atlassian.com/cloud/trello/rest/api-group-members/#api-members-id-field-get https://developer.atlassian.com/cloud/trello/rest/api-group-.... The endpoint allows you to get all public info (bio and username) from a trello account by its email.[2] > Why did it provide personal information? So users can invite other users to their boards via their email address. > Why wasn't it throttled? It should've been. [1]: https://haveibeenpwned.com/PwnedWebsites#Trello https://haveibeenpwned.com/PwnedWebsites#Trello [2]: https://www.bleepingcomputer.com/news/security/trello-api-abused-to-link-email-addresses-to-15-million-accounts/ https://www.bleepingcomputer.com/news/security/trello-api-ab...
jacquesm 3y ago
In many cases: yes. That you need to tell others your email address to be able to use it doesn't mean it can't be used to identify you, especially if your email address is hasty.pudding@gmail.com everybody will know exactly what your proper name is.
- hasty_pudding 3y ago
  yeah but isnt a person's name as public as their email? I can literally go to the tax assessor's website and search an address and find out exactly who owns that property.
  - jacquesm 3y ago
    Not in every country.
itake 3y ago
These emails can be used for targeted advertising: this email works in tech or startups, let’s show ads to them!
- drdaeman 3y ago
  Given that it most certainly doesn't work with current big-name advertising companies, I'm skeptical it's gonna work with some random data leak. But if a data leak finally gives me meaningful ads - that'd be nice.
  - itake 3y ago
    What do you mean? Big tech advertising unfortunately works too well for me. A friend heavily uses the look alike feature on fb to target similar people that purchased his product. Fever ticketing also uses this too. If you’re having ad quality issues, it could be that they don’t have good advertisers matching your profile.
- portaouflop 3y ago
  if you work in tech and you don’t know a way to block all online ads what the hell are you doing
mangosteenjuice 3y ago
They're a part of the composite "keys" tied to managing your personal identity. If you use one email for everything, having that email exposed means that a portion of that key has been compromised, and you may be targeted by attackers that previously did not know of your existence. If you use a unique email for everything, attackers need to determine email+password+whatever, instead of just password+whatever, where "whatever" is security questions or compromising 2FA.

It may depend on definitions. Where I work, we classify users' emails as "personal" information, and we would consider it a breach if all the emails were leaked.

hasty_pudding 3y ago
I can see it being a low tier breach.

Levitating 3y ago

Well as the page states, these were scraped from a public endpoint. So not really

mgbmtl 3y ago
What's the endpoint? Why did it provide personal information? Why wasn't it throttled? Many things don't matter at a small scale, but they do at 15M-scale. Trello users are about to get bombarded by phishing attempts and spam.
- hasty_pudding 3y ago
  Checkmate hackers. I already am bombarded by phishing attempts and spam.
- Levitating 3y ago
  > Trello users are about to get bombarded by phishing attempts and spam. All of the emails present in this "leak" were taken from other dumps. That's how it's made, they took a list of known emails and tried to link them to a trello account.[1] > What's the endpoint? I think https://developer.atlassian.com/cloud/trello/rest/api-group-members/#api-members-id-field-get https://developer.atlassian.com/cloud/trello/rest/api-group-.... The endpoint allows you to get all public info (bio and username) from a trello account by its email.[2] > Why did it provide personal information? So users can invite other users to their boards via their email address. > Why wasn't it throttled? It should've been. [1]: https://haveibeenpwned.com/PwnedWebsites#Trello https://haveibeenpwned.com/PwnedWebsites#Trello [2]: https://www.bleepingcomputer.com/news/security/trello-api-abused-to-link-email-addresses-to-15-million-accounts/ https://www.bleepingcomputer.com/news/security/trello-api-ab...

jacquesm 3y ago

In many cases: yes. That you need to tell others your email address to be able to use it doesn't mean it can't be used to identify you, especially if your email address is hasty.pudding@gmail.com everybody will know exactly what your proper name is.

hasty_pudding 3y ago
yeah but isnt a person's name as public as their email? I can literally go to the tax assessor's website and search an address and find out exactly who owns that property.
- jacquesm 3y ago
  Not in every country.

itake 3y ago

These emails can be used for targeted advertising: this email works in tech or startups, let’s show ads to them!

drdaeman 3y ago
Given that it most certainly doesn't work with current big-name advertising companies, I'm skeptical it's gonna work with some random data leak. But if a data leak finally gives me meaningful ads - that'd be nice.
- itake 3y ago
  What do you mean? Big tech advertising unfortunately works too well for me. A friend heavily uses the look alike feature on fb to target similar people that purchased his product. Fever ticketing also uses this too. If you’re having ad quality issues, it could be that they don’t have good advertisers matching your profile.
portaouflop 3y ago
if you work in tech and you don’t know a way to block all online ads what the hell are you doing

mangosteenjuice 3y ago

They're a part of the composite "keys" tied to managing your personal identity. If you use one email for everything, having that email exposed means that a portion of that key has been compromised, and you may be targeted by attackers that previously did not know of your existence. If you use a unique email for everything, attackers need to determine email+password+whatever, instead of just password+whatever, where "whatever" is security questions or compromising 2FA.