2 ms·

To be fair the 'schofield' has been diligent before: https://www.google.com/search?q=site:hackerone.com+schofield https://www.google.com/search?q=site:hackeron

by diziet 13y ago

To be fair the 'schofield' has been diligent before: https://www.google.com/search?q=site:hackerone.com+schofield https://www.google.com/search?q=site:hackerone.com+schofield Are the relationship pairs actually being exposed? All I can see are the email / name pairs - not who invited the user (and you have to be logged into a Yahoo account).

jamesbrownuhh 13y ago
Leaking someone's email address and associated name is bad enough. If Yahoo don't see that as sensitive it places the ability of miscreants to entirely own and abuse Yahoo Mail accounts in some kind of institutional context.