4 ms·

Jokes on them... I'm already on HIBP countless of times...

jsheard 2y ago
It's all good, as long as you're not in that recent AI Girlfriend breach which exposed a ton of users who were trying to coax it into generating CSAM images. https://x.com/troyhunt/status/1843788319785939422 https://x.com/troyhunt/status/1843788319785939422
- mrkramer 2y ago
  “I went to the site to jerk off (to an adult scenario, to be clear) and noticed that it looked like it [the Muah.ai website] was put together pretty poorly,” the hacker told 404 Media. “It's basically a handful of open-source projects duct-taped together. I started poking around and found some vulnerabilities relatively quickly. At the start it was mostly just curiosity but I decided to contact you once I saw what was in the database.” What a nice guy.
  - throwaway73583 2y ago
    Not sure if you're being sarcastic or not, but pentesting is not a particularly evil activity — and you often have to look at data to see if you actually found something. What is evil is the way that he's ensured that the predators in the dataset will never face any consequences by making the data available to HaveIBeenPwned, making it trivial for predators to protect themselves (the method through which this is possible intentionally left as an exercise for the reader), and making the data available to a news website for...some reason, but it's bound to ensure that the vulnerability will be patched out quickly and no one else will be able to access the data. I find it much more likely that this hacker who sought out a website for uncensored AI erotica isn't actually a good guy, and might even have something to hide within the dataset. Hopefully, I'm wrong and we'll see more of this.
    - lazide 2y ago
      How would that protect predators?
    - urbandw311er 2y ago
      Did you miss the joke? Parent poster means penetration as in penetrative sex
  - rpmisms 2y ago
    True penetration testing.
    - account42 2y ago
      Well, only success with one kind.
to-too-two 2y ago
I'm also on HIBP over 10x. What are we supposed to do? Create a new email address for every service we sign up for? I don't know what the best practice is for keeping our personal data safe anymore.
- lazide 2y ago
  Password manager + unique password per site + 2FA for anything of value.
- BobbyTables2 2y ago
  Using unique email addresses makes phishing attempts extremely obvious… (No, this official looking email from my bank is fake since it was sent to Grocery@my.domain …)
  - wiredfool 2y ago
    I get a ton of "This is your email administrator -- your email password needs to be reset" to github@mydomain
    - account42 2y ago
      Hey at least after they fill your account up with spam they also send you warnings that you are running out of space.
- varenc 2y ago
  > Create a new email address for every service we sign up for? Yes! Just get a domain and have every email it go to you. Mine is something like “@super-secure-no-viruses.email”
  - account42 2y ago
    There are probably people that would sign up for such a mail. Like urlify.io and other similar URL "shorteners".
- 2y ago
nxobject 2y ago
And my SSN's probably available for purchase with 9 types of crypto, too.

It's all good, as long as you're not in that recent AI Girlfriend breach which exposed a ton of users who were trying to coax it into generating CSAM images. https://x.com/troyhunt/status/1843788319785939422 https://x.com/troyhunt/status/1843788319785939422

mrkramer 2y ago
“I went to the site to jerk off (to an adult scenario, to be clear) and noticed that it looked like it [the Muah.ai website] was put together pretty poorly,” the hacker told 404 Media. “It's basically a handful of open-source projects duct-taped together. I started poking around and found some vulnerabilities relatively quickly. At the start it was mostly just curiosity but I decided to contact you once I saw what was in the database.” What a nice guy.
- throwaway73583 2y ago
  Not sure if you're being sarcastic or not, but pentesting is not a particularly evil activity — and you often have to look at data to see if you actually found something. What is evil is the way that he's ensured that the predators in the dataset will never face any consequences by making the data available to HaveIBeenPwned, making it trivial for predators to protect themselves (the method through which this is possible intentionally left as an exercise for the reader), and making the data available to a news website for...some reason, but it's bound to ensure that the vulnerability will be patched out quickly and no one else will be able to access the data. I find it much more likely that this hacker who sought out a website for uncensored AI erotica isn't actually a good guy, and might even have something to hide within the dataset. Hopefully, I'm wrong and we'll see more of this.
  - lazide 2y ago
    How would that protect predators?
  - urbandw311er 2y ago
    Did you miss the joke? Parent poster means penetration as in penetrative sex
- rpmisms 2y ago
  True penetration testing.
  - account42 2y ago
    Well, only success with one kind.

to-too-two 2y ago

I'm also on HIBP over 10x. What are we supposed to do? Create a new email address for every service we sign up for? I don't know what the best practice is for keeping our personal data safe anymore.

lazide 2y ago
Password manager + unique password per site + 2FA for anything of value.
BobbyTables2 2y ago
Using unique email addresses makes phishing attempts extremely obvious… (No, this official looking email from my bank is fake since it was sent to Grocery@my.domain …)
- wiredfool 2y ago
  I get a ton of "This is your email administrator -- your email password needs to be reset" to github@mydomain
  - account42 2y ago
    Hey at least after they fill your account up with spam they also send you warnings that you are running out of space.
varenc 2y ago
> Create a new email address for every service we sign up for? Yes! Just get a domain and have every email it go to you. Mine is something like “@super-secure-no-viruses.email”
- account42 2y ago
  There are probably people that would sign up for such a mail. Like urlify.io and other similar URL "shorteners".
2y ago

nxobject 2y ago

And my SSN's probably available for purchase with 9 types of crypto, too.