4 ms·
Chess.com Leak Exposes 7.3M Users, Evidence Points to Scraping
- unixhero 19d agoIs scraping wrong that, is the question.
- Shank 19d ago> Every record has gam_audiences and audiences_member_of populated, Google Ad Manager audience segments, with values like coach-nudge experiment groups, trial eligibility, lapsed-user cohorts and rating-band targeting. It sure seems like the evidence doesn't point to scraping to me.
- emodendroket 19d agoI'm assuming they're basing this on the no-passwords part.
- happosai 19d agoHave I been pwned reports 99% of email addresses from chess.com leak were already in their database. Rather strong indicator that the Hacker scraped an API with a list of email addresses. https://infosec.exchange/@haveibeenpwned/117263977537458510 https://infosec.exchange/@haveibeenpwned/117263977537458510
- sidrag22 19d ago> The data had been pulled by abusing the platform’s find-friends feature Sounds like the find-friends feature shouldn't allow access to the majority of that data unless the "friend" accepts, don't think the "scraper" got 7mil accepts just because they had access to emails... To me this is 100% a breach, even more so because its already happened once years ago to 700k, and they changed nothing to prevent it.
- samus 19d agoIt might very well be possible that there were API endpoints that exposed way too much information. I also think that this wouldn't qualify as "scraping".
- jeroenhd 19d agoA lot of chess.com information is public (by default) if you know someone's profile. Stuff a couple million email addresses and phone numbers into the "find friend" API and all you need to get profile information is the associated account username. Chess.com should probably prevent scraping, but as we can read in just about every comment thread about LLMs/Cloudflare/Anubis/Go-away, that's not as easy as it sounds these days.
- ed_mercer 19d agoemail? Is a user's email up for grabs just like that?
- jibal 19d agoemail gets you username via find-friends, not the reverse. The emails were obtained independently of chess.com
- TheSpacerr 19d agoBasically our data is free.
- zx8080 19d agoPeasants have no rights and shall be slaves.
- nilslindemann 19d agoI just logged in to delete my chess.com account, got a message: "This account is closed, please log in with your e-Mail to reactivate". No word by them having been hacked.
- MiroslavPokorny 19d agoHack or scraping, both are equally bad.
- m00x 19d agouh oh. If my ELO gets back to my friends I'm going to be very embarrassed.
- OutOfHere 16d agoI closed my account before they find out and trace my moves.
- Lucasoato 19d agoI just got a message from an Hacker: "You seriously just played London opening as white and King Indian defense as black for the last 3 months?" Btw I hate that chess.com puts game reviews under their most expensive plan, I ain't paying so much for something I can get in lichess for free.
- gregorygoc 19d agoExactly, chess.com is at value extraction phase. Lichess is much better platform now.
- mitxela 19d agoWasn't this literally always the case and the very reason lichess was created? And yet it remains #2.
- demibabs 19d agoSome battles are won at the domain registry.
- a_c 19d agoI only started playing less than a year ago. I paid for one year because of game review to improve my game. Didn't know lichess exist, but I'm not paying for a second year for sure
- efilife 19d agoWhat's the forum shown in the screenshot?
- lhk931122 19d ago[dead]
- dwroberts 19d agoWorth noting this was reported back in August, it’s not new
- specproc 19d agoLichess.org is an internet gem. No ads, no subs, incredible performance, low-toxicity, fully featured, free API, European. Far superior to chess.com in all regards. If you're still on chess.com, make this your opportunity to switch. You won't regret it.
- stavros 19d agoI'm loving that "European" is a selling point now, but yes, agreed. Lichess is a gem.
- Mydayyy 19d agoWhen I started playing online chess, which was around a year before the hype came with corona, I checked out both websites chess.com and Lichess. I very quickly decided to use Lichess since it just appeared superior in all aspects and it, in my opinion, look way better. Almost all of the people I met who play chess prefer chess.com and I just don't understand it. I just never managed to warm up with that site
- OutOfHere 16d agoAfter reading this, the only respectable thing to do was to close my account, and I did close it. Email addresses were not supposed to be leaked but they were, which hints at atrocious security.