5 ms·

Got an account on a site like Github? Hackers may know your e-mail address

38 points by martey 13y ago

thejosh 13y ago
Doesn't github also store it in a json response?
- cmelbye 13y ago
  Yes. https://api.github.com/users/mojombo https://api.github.com/users/mojombo
  - Aqua_Geek 13y ago
    IIRC, your email only comes back from the API if you've entered something into the "Email (will be public)" field in your profile. They also allow you to use a separate email for Gravatar.
zalew 13y ago
the gravatar email recovery hack has been known for years, they are recycling an old topic. luckily my email isn't a secret as I publish it everywhere willingly.
- jdubs 13y ago
  The problem is that since they know your email address, they can find your email from leaked databases... Then try that password to own your repo...
  - zalew 13y ago
    what password?
    - warcode 13y ago
      That one single password you use on all webpages, clearly.
    - asperous 13y ago
      Assuming: * A hacker has a leaked database * Your email and password are in this database * Your public email is the same one used in the database * Plain-text passwords are easy to extract from this leaked databases * You use the same password and email combination other places * Other places with that email/password don't use two-step authentication Then if they have your email they can get your password and try it other places
      - kintamanimatt 13y ago
        > You use the same password and email combination other places This is the problem. Every password for every account you create should be unique. Bonus points if you use a unique email alias for every account you create too.
deleted 13y ago
[deleted]
Smerity 13y ago
Singling out GitHub seems silly. If you're on GitHub, have a .gitconfig with name + email, and you've made a commit, then that's all public. If a site uses your Gravatar, game over: Gravatar's literally a raw MD5 of your email with the aim to give you a globally identifiable avatar. That's been known (documented!) for a long time and unlikely to be a surprise to many of us here. The only place this is likely to be an issue is when a site knows you but you assume you're anonymous. If you're using a web service where you want to be anonymous, connecting anything with your identity is a bad idea.
- scdoshi 13y ago
  Exactly what I was thinking. If you commit to github, your account email is already public.
- martey 13y ago
  > The only place this is likely to be an issue is when a site knows you but you assume you're anonymous. If you're using a web service where you want to be anonymous, connecting anything with your identity is a bad idea. While I wish the article headline mentioned Gravatar as opposed to Github, I think it is worth realizing that Github provides instructions to use a fake email address in your .gitconfig to protect your privacy [1] while simultaneously requiring you to provide a valid email address while setting up your account. [2] [1]: https://help.github.com/articles/keeping-your-email-address-private https://help.github.com/articles/keeping-your-email-address-... [2]: https://help.github.com/articles/github-terms-of-service#a-account-terms https://help.github.com/articles/github-terms-of-service#a-a...
jff 13y ago
My email address? Oh god no!
- zalew 13y ago
  I just hacked your hn profile, expect me sending you an email.
- WayneDB 13y ago
  [In the voice of Steven Wright]: I'd like to get an email address that nobody knows. That way when I don't get any email, I won't be disappointed...
- chrischen 13y ago
  slawmaster at... that google email provider. I managed to decode that after a few hours of brute forcing. You should apply some stronger obfuscation methods.
cbhl 13y ago
The article title is link bait. The article is about Gravatar, and GitHub only matters because it utilizes Gravatar. (Your email address may be visible in all sorts of other ways on GitHub, such as when someone does git log on a public git repository.) If you're worried about your Gravatar being matched to your inflammatory (i.e., trolling) Hacker News or WordPress comments, you probably should be using a separate email account and Tor and whatnot.
deadslow 13y ago
Post something new.
deadslow 13y ago
Post something new.
walesmd 13y ago
Isn't this public knowledge? "Oh no! 'Hackers' have my oh-so-sacred email address! Yeah, that thing on all of my sites, business cards, dozens of whois records, resumes, speaker decks, the Dominoes online ordering system, and so on... What shall I ever do?" I'd seriously question their talent if they weren't able to find it.
- warp 13y ago
  Yes, developers have known about this problem for years. But Gravatar and sites using Gravatar are terrible at explaining these risks to less technical users. Those users have an expectation of privacy when a site claims they won't share their e-mail address with anyone. No one has told them how incredibly easy it is to verify that their user account on one of the sites they use is the same person as a user account on a different site.

38 points by martey 13y ago

thejosh 13y ago

Doesn't github also store it in a json response?

cmelbye 13y ago
Yes. https://api.github.com/users/mojombo https://api.github.com/users/mojombo
- Aqua_Geek 13y ago
  IIRC, your email only comes back from the API if you've entered something into the "Email (will be public)" field in your profile. They also allow you to use a separate email for Gravatar.

zalew 13y ago

the gravatar email recovery hack has been known for years, they are recycling an old topic. luckily my email isn't a secret as I publish it everywhere willingly.

jdubs 13y ago
The problem is that since they know your email address, they can find your email from leaked databases... Then try that password to own your repo...
- zalew 13y ago
  what password?
  - warcode 13y ago
    That one single password you use on all webpages, clearly.
  - asperous 13y ago
    Assuming: * A hacker has a leaked database * Your email and password are in this database * Your public email is the same one used in the database * Plain-text passwords are easy to extract from this leaked databases * You use the same password and email combination other places * Other places with that email/password don't use two-step authentication Then if they have your email they can get your password and try it other places
    - kintamanimatt 13y ago
      > You use the same password and email combination other places This is the problem. Every password for every account you create should be unique. Bonus points if you use a unique email alias for every account you create too.

deleted 13y ago

[deleted]

Smerity 13y ago

Singling out GitHub seems silly. If you're on GitHub, have a .gitconfig with name + email, and you've made a commit, then that's all public. If a site uses your Gravatar, game over: Gravatar's literally a raw MD5 of your email with the aim to give you a globally identifiable avatar. That's been known (documented!) for a long time and unlikely to be a surprise to many of us here. The only place this is likely to be an issue is when a site knows you but you assume you're anonymous. If you're using a web service where you want to be anonymous, connecting anything with your identity is a bad idea.

scdoshi 13y ago
Exactly what I was thinking. If you commit to github, your account email is already public.
martey 13y ago
> The only place this is likely to be an issue is when a site knows you but you assume you're anonymous. If you're using a web service where you want to be anonymous, connecting anything with your identity is a bad idea. While I wish the article headline mentioned Gravatar as opposed to Github, I think it is worth realizing that Github provides instructions to use a fake email address in your .gitconfig to protect your privacy [1] while simultaneously requiring you to provide a valid email address while setting up your account. [2] [1]: https://help.github.com/articles/keeping-your-email-address-private https://help.github.com/articles/keeping-your-email-address-... [2]: https://help.github.com/articles/github-terms-of-service#a-account-terms https://help.github.com/articles/github-terms-of-service#a-a...

jff 13y ago

My email address? Oh god no!

zalew 13y ago
I just hacked your hn profile, expect me sending you an email.
WayneDB 13y ago
[In the voice of Steven Wright]: I'd like to get an email address that nobody knows. That way when I don't get any email, I won't be disappointed...
chrischen 13y ago
slawmaster at... that google email provider. I managed to decode that after a few hours of brute forcing. You should apply some stronger obfuscation methods.

cbhl 13y ago

The article title is link bait. The article is about Gravatar, and GitHub only matters because it utilizes Gravatar. (Your email address may be visible in all sorts of other ways on GitHub, such as when someone does git log on a public git repository.) If you're worried about your Gravatar being matched to your inflammatory (i.e., trolling) Hacker News or WordPress comments, you probably should be using a separate email account and Tor and whatnot.

deadslow 13y ago

Post something new.

deadslow 13y ago

Post something new.

walesmd 13y ago

Isn't this public knowledge? "Oh no! 'Hackers' have my oh-so-sacred email address! Yeah, that thing on all of my sites, business cards, dozens of whois records, resumes, speaker decks, the Dominoes online ordering system, and so on... What shall I ever do?" I'd seriously question their talent if they weren't able to find it.

warp 13y ago
Yes, developers have known about this problem for years. But Gravatar and sites using Gravatar are terrible at explaining these risks to less technical users. Those users have an expectation of privacy when a site claims they won't share their e-mail address with anyone. No one has told them how incredibly easy it is to verify that their user account on one of the sites they use is the same person as a user account on a different site.