5 ms·

> including email addresses, phone numbers, and other unspecified “internal metadata.” > Substack specified that more sensitive data, such as credit card numbe

> including email addresses, phone numbers, and other unspecified “internal metadata.” > Substack specified that more sensitive data, such as credit card numbers, passwords, and other financial information, was unaffected. I hate it when companies do this. passwords and credit card numbers are easily changed. names, emails and phone numbers are not.

parable 8mo ago
This is what I've been saying for years. I really could care less if my passwords were leaked. My phone number, on the other hand, is near-impossible to change. The fact that VoIP/virtual numbers are blacklisted from use almost everywhere doesn't help anything, because otherwise I would just use a ton of cheap rented numbers. The same goes for full names on file, physical addresses, and other hard-to-change information. Passwords have been the least of my concerns since password managers were invented. You could, in theory, use a custom domain or email aliasing service like SimpleLogin or Addy to combat the email address issue, though websites like GitHub have been known to block emails created with an aliasing service. I could go on about why that move does next to nothing to combat actual abuse; any spammer worth their salt can just buy a bunch of Gmail accounts or Outlook accounts instead.
- hikkerl 8mo ago
  >I really could care less if my passwords were leaked couldn't*
  - UqWBcuFx6NV4r 8mo ago
    [flagged]
    - jstanley 8mo ago
      It is a common saying, but the saying is "couldn't care less"
      - re 8mo ago
        They are commonly used synonymously. English as she is spoke is not a logical language. https://www.merriam-webster.com/grammar/could-couldnt-care-less https://www.merriam-webster.com/grammar/could-couldnt-care-l... https://dictionary.cambridge.org/dictionary/english/could-care-less https://dictionary.cambridge.org/dictionary/english/could-ca...
        decremental 8mo ago
        [dead]
    - chrisjj 8mo ago
      Try: "It is impossible that he could care less." — The Morning Post (London, Eng.), 18 Jul. 1840
  - pwdisswordfishy 8mo ago
    Maybe they really care more than they should.
- drcongo 8mo ago
  https://cinemaphile.com/watch?v=om7O0MFkmpw https://cinemaphile.com/watch?v=om7O0MFkmpw
praptak 8mo ago
Phone numbers are kinda concerning given their popularity as 2FA. A phone number is now basically your shared password for everything. It's also semi public, hard to change and you are basically one SIM swap attack away from a full compromise.
- direwolf20 8mo ago
  Europeans (who are the ones notified of the attack) enjoy significant bureaucracy around getting a SIM card assigned or reassigned.
parable 8mo ago
I'd edit my other reply to this comment but can't anymore. Here are the columns from the CSV file I've seen being shared around on forums, including the "internal metadata". This mostly boils down to full name on file, email, Stripe customer ID, activity metrics, usernames, and phone numbers. Everything else is largely irrelevant. id,name,email,email_confirmed,email_confirmation_token,stripe_platform_customer_id,is_global_admin,is_ghost,created_at,anonymous_id,email_bounce_count,photo_url,publisher_agreement_accepted_at,bio,updated_at,profile_set_up_at,tos_accepted_at,email_digest_at,has_passed_captcha,import_confirmation_required,post_notification_preference,reader_installed_at,activity_items_viewed_at,dismissed_ios_app_promo_at,email_notifications_last_resumed_at,previous_name,release_group,handle,phone,bank_payment_failures,is_globally_banned,session_version
rvz 8mo ago
Phone number login in 2026 is really just asking for someone to do a SIM swap attack on the victim's account to steal their identity. Surely a list of services that allow phone number logins exists so that one can avoid signing up in the first place and we would then see it in another connecting breach.
- chrisjj 8mo ago
  PayPal :(
- jtbayly 8mo ago
  Most banks and credit cards, as far as I’ve seen. For example, I tried to set up another form of 2FA on Chase, but it still defaults to phone. I can’t disable or change it.
BiteCode_dev 8mo ago
Also, name, address and phone numbers let you do so many scams. A friend of mine received a very well-crafted physical letter at his home about resetting his cryto ledger. He is now very stressed because there are news about people with crypto getting abducted. And with the ledger leak they have: - his name and address - how much money he has on his ledger

parable 8mo ago

This is what I've been saying for years. I really could care less if my passwords were leaked. My phone number, on the other hand, is near-impossible to change. The fact that VoIP/virtual numbers are blacklisted from use almost everywhere doesn't help anything, because otherwise I would just use a ton of cheap rented numbers. The same goes for full names on file, physical addresses, and other hard-to-change information. Passwords have been the least of my concerns since password managers were invented. You could, in theory, use a custom domain or email aliasing service like SimpleLogin or Addy to combat the email address issue, though websites like GitHub have been known to block emails created with an aliasing service. I could go on about why that move does next to nothing to combat actual abuse; any spammer worth their salt can just buy a bunch of Gmail accounts or Outlook accounts instead.

hikkerl 8mo ago
>I really could care less if my passwords were leaked couldn't*
- UqWBcuFx6NV4r 8mo ago
  [flagged]
  - jstanley 8mo ago
    It is a common saying, but the saying is "couldn't care less"
    - re 8mo ago
      They are commonly used synonymously. English as she is spoke is not a logical language. https://www.merriam-webster.com/grammar/could-couldnt-care-less https://www.merriam-webster.com/grammar/could-couldnt-care-l... https://dictionary.cambridge.org/dictionary/english/could-care-less https://dictionary.cambridge.org/dictionary/english/could-ca...
      - decremental 8mo ago
        [dead]
  - chrisjj 8mo ago
    Try: "It is impossible that he could care less." — The Morning Post (London, Eng.), 18 Jul. 1840
- pwdisswordfishy 8mo ago
  Maybe they really care more than they should.
drcongo 8mo ago
https://cinemaphile.com/watch?v=om7O0MFkmpw https://cinemaphile.com/watch?v=om7O0MFkmpw

praptak 8mo ago

Phone numbers are kinda concerning given their popularity as 2FA. A phone number is now basically your shared password for everything. It's also semi public, hard to change and you are basically one SIM swap attack away from a full compromise.

direwolf20 8mo ago
Europeans (who are the ones notified of the attack) enjoy significant bureaucracy around getting a SIM card assigned or reassigned.

parable 8mo ago

I'd edit my other reply to this comment but can't anymore. Here are the columns from the CSV file I've seen being shared around on forums, including the "internal metadata". This mostly boils down to full name on file, email, Stripe customer ID, activity metrics, usernames, and phone numbers. Everything else is largely irrelevant. id,name,email,email_confirmed,email_confirmation_token,stripe_platform_customer_id,is_global_admin,is_ghost,created_at,anonymous_id,email_bounce_count,photo_url,publisher_agreement_accepted_at,bio,updated_at,profile_set_up_at,tos_accepted_at,email_digest_at,has_passed_captcha,import_confirmation_required,post_notification_preference,reader_installed_at,activity_items_viewed_at,dismissed_ios_app_promo_at,email_notifications_last_resumed_at,previous_name,release_group,handle,phone,bank_payment_failures,is_globally_banned,session_version

rvz 8mo ago

Phone number login in 2026 is really just asking for someone to do a SIM swap attack on the victim's account to steal their identity. Surely a list of services that allow phone number logins exists so that one can avoid signing up in the first place and we would then see it in another connecting breach.

chrisjj 8mo ago
PayPal :(
jtbayly 8mo ago
Most banks and credit cards, as far as I’ve seen. For example, I tried to set up another form of 2FA on Chase, but it still defaults to phone. I can’t disable or change it.

BiteCode_dev 8mo ago

Also, name, address and phone numbers let you do so many scams. A friend of mine received a very well-crafted physical letter at his home about resetting his cryto ledger. He is now very stressed because there are news about people with crypto getting abducted. And with the ledger leak they have: - his name and address - how much money he has on his ledger