5 ms·
In December I found a glitch in my university's directory that let me have access to personal info of over 60,000 professors, students, and staff. I was thinki
by xux 13y ago
In December I found a glitch in my university's directory that let me have access to personal info of over 60,000 professors, students, and staff.
I was thinking of writing an email to the IT, but fuck that. I'm not paying for someone else's mistake.
- brianbarker 13y agoSend an anonymous email or other notification to them? I agree it's scary to be penalized for "hacking" the system (in their eyes), but I also think these things can't be left alone. It'd be cool if you found a way to let them know.
- r00fus 13y agoWhat's an anonymous email? Even Tor is subject to tracking if the endpoint IPs are monitored [1]. The issue of anonymous disclosure is a real issue if you don't Why do you think Wikileaks was such a big/new deal? [1] http://www.forbes.com/sites/runasandvik/2013/12/18/harvard-student-receives-f-for-tor-failure-while-sending-anonymous-bomb-threat/ http://www.forbes.com/sites/runasandvik/2013/12/18/harvard-s...
- deleted 13y ago[deleted]
- brianbarker 13y agoLol, you've never opened a gmail account using fake data and sent from there? Yahoo? Hotmail? The FBI will help your sys admin investigate a bomb threat, obviously. Reporting a security hole will unlikely draw their interest. Yes, just using a fake gmail account is tracable without more protections (like correctly accessing Tor). Again, I doubt the FBI is going to investigate. But hey, I'm all for paranoia and extra caution. Plus, rtfa you linked. It says clearly in the first few paragraphs that Tor did NOT fail this guy, but that he's an idiot in how he accessed it. Lastly, as mentioned, send an anonymous letter. It's not hard, kids!
- r00fus 13y agoIf what you're reporting is significant enough to threaten the livelihood or reputation of people important enough, they can and will find a way to trace you via your fingerprints/IPs … or do you think Google won't simply roll over on you when they get a subpoena/warrant?
- brianbarker 13y agoI already gave you the answer. Send an anonymous letter. Done.
- dkuntz2 13y agoOr, similarly, drop a physical, paper note off under their door explaining the problem.
- caprad 13y agoThen you have to worry that they might track you down. How will you send an anonymous email? The library will have cameras, so might the coffee shop. The fake email you setup might store information about your location as well. You can never be too careful. It might be better to send a regular old mail.
- gatehouse 13y agoYou could send a postcard through regular mail to the head of IT's house, I think that would get the point across haha. They might be able to find you by checking access logs after the fact though, I don't think there is any riskless way to disclose.