3 ms·

I can confirm the veracity of the email. I got it myself. Note that they say they leaked passwords. They didn't mention whether they were hashed or not, and if

I can confirm the veracity of the email. I got it myself. Note that they say they leaked passwords. They didn't mention whether they were hashed or not, and if so whether with salt or not. I couldn't find a blog post either. The notification email took more than 3 weeks, not impressed.

flutas 2y ago
Interesting, as I have an active account (ADS-B data feed) with them and never got this email.
- croemer 2y ago
  You will probably still get it then. I only got it 3 hours ago. And the first tweets are almost 2 days old. They seem to use some email delivery service that can't handle sending an email to all users within an hour.
  - flutas 2y ago
    Jeez, that's terrible...
    - technion 2y ago
      It's terrible for end users, bit to be fair here a domain that sends little mail suddenly sending a lot looks like spam. Ciscos sender base for example graphs long term volume per domain as a key indicator, and their data feeds into several mail services. You're much more likely to at least get the email this way.
      - croemer 2y ago
        If they really cared about reaching users they might also want to put something on their website. There's absolutely nothing there.
    - croemer 2y ago
      I can't confirm that's the reason, but I don't see why they would drip send it otherwise. Also the reply-to email is bounces+MYEMAILADDRESS@bounces.flightaware.com (@ replaced by =)
- SushiHippie 2y ago
  Same, but I tried logging in and got the reset your password popup because of a breach.
  - blitzar 2y ago
    > Additional information was sent to you via email Got the same prompt when I logged in - no email despite their insistence they sent it.
    - croemer 2y ago
      It probably _has_ been sent, it just hasn't _arrived_ yet!
bigmoat 2y ago
As someone who used to work there, the passwords were definitely stored salted and hashed in the database. The email mostly makes it sound like what’s in the user account table, though last 4 of credit card I didn’t think was in it. And mentioning passwords, not salted/hashed passwords, makes me think it was more. I’m wondering if this is an Apache or Apache Rivet issue that possibly intercepted everything you sent to the server, which could then be your actual password if you logged in during the timeframe or even credit card if you bought something. Also Rivet was full of footguns. IIRC, variables would exist for the life of the Apache child, so you had to clear them out or the next request had access to them, so if someone deleted or didn’t run the huge “delete all variables we probably set” proc, and someone was able to get an “info var” output, they’d see everything set in the previous request or further back if nothing overrode it. Like user info, which was just stored in a big global “user” array
- croemer 2y ago
  Thanks that the most informative thing about this incident that exists at this point. Nothing on the website at all. It's terrible. The blog mentions recently moving away from TCL. Could it have been related to that? Do you have an idea why the emails arrive as a drip, spread over days?
  - bigmoat 2y ago
    The website still looks like the TCL monster it has always been, so I doubt it. But I have no intimate knowledge of the inner workings there soon after the Raytheon buyout.
    - croemer 2y ago
      Oh it is owned by Raytheon a huge listed company. That makes it more surprising that the communication is so bad. I'd expect a public company with market cap of $150b to have its act together regarding crisis communication.
      - stackskipton 2y ago

flutas 2y ago

Interesting, as I have an active account (ADS-B data feed) with them and never got this email.

croemer 2y ago
You will probably still get it then. I only got it 3 hours ago. And the first tweets are almost 2 days old. They seem to use some email delivery service that can't handle sending an email to all users within an hour.
- flutas 2y ago
  Jeez, that's terrible...
  - technion 2y ago
    It's terrible for end users, bit to be fair here a domain that sends little mail suddenly sending a lot looks like spam. Ciscos sender base for example graphs long term volume per domain as a key indicator, and their data feeds into several mail services. You're much more likely to at least get the email this way.
    - croemer 2y ago
      If they really cared about reaching users they might also want to put something on their website. There's absolutely nothing there.
  - croemer 2y ago
    I can't confirm that's the reason, but I don't see why they would drip send it otherwise. Also the reply-to email is bounces+MYEMAILADDRESS@bounces.flightaware.com (@ replaced by =)
SushiHippie 2y ago
Same, but I tried logging in and got the reset your password popup because of a breach.
- blitzar 2y ago
  > Additional information was sent to you via email Got the same prompt when I logged in - no email despite their insistence they sent it.
  - croemer 2y ago
    It probably _has_ been sent, it just hasn't _arrived_ yet!

bigmoat 2y ago

As someone who used to work there, the passwords were definitely stored salted and hashed in the database. The email mostly makes it sound like what’s in the user account table, though last 4 of credit card I didn’t think was in it. And mentioning passwords, not salted/hashed passwords, makes me think it was more. I’m wondering if this is an Apache or Apache Rivet issue that possibly intercepted everything you sent to the server, which could then be your actual password if you logged in during the timeframe or even credit card if you bought something. Also Rivet was full of footguns. IIRC, variables would exist for the life of the Apache child, so you had to clear them out or the next request had access to them, so if someone deleted or didn’t run the huge “delete all variables we probably set” proc, and someone was able to get an “info var” output, they’d see everything set in the previous request or further back if nothing overrode it. Like user info, which was just stored in a big global “user” array

croemer 2y ago
Thanks that the most informative thing about this incident that exists at this point. Nothing on the website at all. It's terrible. The blog mentions recently moving away from TCL. Could it have been related to that? Do you have an idea why the emails arrive as a drip, spread over days?
- bigmoat 2y ago
  The website still looks like the TCL monster it has always been, so I doubt it. But I have no intimate knowledge of the inner workings there soon after the Raytheon buyout.
  - croemer 2y ago
    Oh it is owned by Raytheon a huge listed company. That makes it more surprising that the communication is so bad. I'd expect a public company with market cap of $150b to have its act together regarding crisis communication.
    - stackskipton 2y ago