8 ms·
“I Emailed 97,931 Users Their Passwords”
- supster 11y agoThis is awesome, very nice of you. Many thanks to you!
- nly 11y agoWhile I support this valiant effort, aren't there often legal implications to doing this?
- jakejake 11y agoIt might be considered spam for one thing. The emails are unsolicited and it might be seen as a subtle promotion of the urhack project. I'm not sure that collecting and sending the passwords is illegal but I'm sure that wouldn't stop some litigious person from causing grief.
- pluma 11y agoThey're definitely unsolicited. If they are also promotional, that would make them illegal -- at least in the EU.
- julianj 11y agoWhile it may be naive, I was hoping that doing the right thing would prevail. I tried to ease the spam heartburn by offering an option to unsubscribe.
- harrisonjackson 11y agoNice work! At a glance, the email you sent out does look sort of spammy. If you plan on doing it again you might get better feedback by making it a bit more human - ie "I'm just a guy/gal trying to help yall out - hope you don't use this password everywhere because someone posted it to pastebin.... - have a good one!" or something like that. Out of curiosity - what did you use to scrape pastebin?
- julianj 11y agoThat's a good idea. I will give that a shot. To scrape pastebin I used a mutated version of a python script by Xavier Garcia. The only change I made was to save a copy of the paste. The version I adapted is located here: http://www.shellguardians.com/2011/07/monitoring-pastebin-leaks.html http://www.shellguardians.com/2011/07/monitoring-pastebin-le...
- jwcrux 11y agoI created a Twitter bot called @dumpmon (recently suspended for no apparent reason) that scraped paste sites looking for password dumps and tweeting if one was found. You can find the code here: http://github.com/jordan-wright/dumpmon http://github.com/jordan-wright/dumpmon. Here are some stats if anyone is interested in what it collected over approx. 2 years: http://jordan-wright.com/blog/2015/05/26/two-years-of-at-dumpmon/ http://jordan-wright.com/blog/2015/05/26/two-years-of-at-dum...
- shayanjm 11y agoI remember chatting with you a while back as I was also working on a pastebin scraping project. http://github.com/shayanjm/pasteye http://github.com/shayanjm/pasteye Glad to see dumpmon is still going strong :)
- jwcrux 11y agoIt is... just not on Twitter anymore. The account was suspended about a week or two ago and I haven't heard anything back on my appeal from Twitter.
- shayanjm 11y agoShameless self-plug - I built a "pastebin scraper as a service" platform, and released it here: https://github.com/shayanjm/pasteye https://github.com/shayanjm/pasteye Took much inspiration from dumpmon, but distributed it so users can choose their own sensitivity settings.
- ocdtrekkie 11y agoThis is a pretty useful service. I do check sites tracking these compromises on occasion, and I know at least one password I used before has been compromised, but it wasn't one I'd used in years. My biggest concern is that your subject line sounds like plenty of spam/phishing emails, and your URL may get blacklisted by email services if you do this often enough. From a slightly higher effort standpoint, you might be able to work with major email service providers to ship these notifications to users in a more official capacity.
- kanusterkund 11y agoThe problem isn't that the subject line sounds spammy, it's that the spam mails try to sound legitimate. This may in turn create problems for actually legit messages. Maybe putting the scraped password in the subject line catches the recipients' attention.
- ocdtrekkie 11y agoThat would probably help. "Your password, xxxx, has been compromised." Even if they think it's spam, they should immediately realize they do need to change their password.
- julianj 11y agoThat's a good idea. Maybe a subject line like your password p*rd has been compromised.
- ocdtrekkie 11y agoPassword is already compromised, so this is a worthless step. And only seeing part of the password may cause them to think it's largely still secure or something. (Some people don't understand wildcards.)
- julianj 11y agoGood point
- meburns 11y agocached version -> http://webcache.googleusercontent.com/search?q=cache:tQP6ur9of4IJ:atechdad.com/i-emailed-97931-users-their-passwords/+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:tQP6ur9...
- Aardwolf 11y agoThanks :) Since it says "Error establishing a database connection", I wonder if someone misused the password of their database?
- scarecrowbob 11y agoNaw, that's what happens when WordPress is overtaxed.
- julianj 11y agoYeah-- I was not expecting this kind of traffic- I am reizing.... the box, hopefully this resolves the issue very soon.
- meburns 11y agoI think scarecrowbob is right, but it would be very ironic if his site's DB pass was compromised ;)
- mynameisvlad 11y ago> Including one request to Fk off. If someone had just sent me an email letting me know that my email and password are out there in the wild, "fuck off" would not be my first reaction. That's just rude.
- hartator 11y agoSending unsolicited automated emails, even for good, may be considered rude as well.
- mynameisvlad 11y agoReally? Do people seriously have this notion? Yes, sending actual spam is rude. But an unsolicited automated email can easily be deleted, especially if it's one time. I would never associate "rude" with that, maybe "annoying" at worst.
- nicky0 11y agoFor me: Unsolicited automated email = Spam. Unsolicited semi-automated (i.e. fill in the blanks) email = Spam. Unsolicited personal email actually written by a human = OK. Followup to unsolicited email because I didn't reply to the first one = Very rude. Instant blacklist of sender.
- hartator 11y agoAnother thing to consider, these emails were also sent as a way to educate people about web security. I am not surprised that unsolicited automated emails to educate oneself are considered rude by some people. Also for ref: http://dontevenreply.com/view.php?post=99 http://dontevenreply.com/view.php?post=99
- DanBC 11y agoBut this is actual spam! It's bulk, and unsolicited. The content doesn't matter.
- 11y ago
- dalerus 11y agoDid you track open rates? I would be curious to see what those numbers look like.
- mfoy_ 11y agoIs there any reliable way to do this? Most mail clients will block receipt-type stuff by default...
- mason240 11y agoI believe the trick is to put a hidden, 1px image in the email. Then you can track how many times it was requested.
- mfoy_ 11y agoI'm familiar with the tracking image "trick" but I assumed most email clients wouldn't load those by default. The other comments seem to indicate I was wrong. :(
- nandhp 11y agoMost reputable email clients won't load remote images in email messages.
- antsar 11y agoHow many mail clients load those by default nowadays? Gmail doesn't, Thunderbird doesn't.
- mynameisvlad 11y agoUm, Gmail does: https://support.google.com/mail/answer/145919?hl=en https://support.google.com/mail/answer/145919?hl=en > Gmail automatically shows you the images in your messages It does have an option to turn it off, but the default is on. They will load up the image themselves, then serve it from their domain, but, as the help information shows, that still indicates an "open", it's just that all the information on who opened the email (IP address, etc) would be wrong.
- BorisMelnik 11y agoThe database error is such a touche right now in this post :)
- DanBC 11y agoGo careful. This is probably against the ToS of whatever internet services you're using. > The thank you notes I got were sincere. One of them validated the entire effort when the person indicated that they use the same password for everything and wanted to know which account had been compromised I hope they don't only change the password on that one site!
- terminado 11y agoThis is a cute experiment, but unfortunately the integrity of the service is is easily corrupted. The biggest problem is being prone to misinformation. There's nothing to prevent people from posting arbitrary e-mail lists to pastebin, with purported matching passwords, as an effort to provoke your service to cry wolf. A few suggestions to harden the service: - provide integrity when sending the message by including a PGP signature. what's to stop someone from running an e-mail server and spamming mass e-mail lists with message headers that spoof your mail domain, and proclaim bogus security lapses? - in general, e-mail itself is not assuredly secure. sending people an e-mail is not enough, since the message might be intercepted as plaintext, and altered in transit. furthermore, those intercepting the e-mail might scoop up credentials and use them. if your service is a reliable source of working credentials, who better to attack? maybe you risk making the problem worse? - consider hosting a secure web page over SSL, and mail links to your site. if your service gains a positive reputation, users might be able to acknowledge past leaks, but elect to receive further notices if other leaks recur elsewhere. maybe users can see links to the source someone is using to post their info, and whether the situation has been remedied by a take-down. this might be a questionable activity: if you send people to that same breach, will they look at the same list and abuse other users on the list? but what better way to demonstrate the breach? - provide a means to verify the level exposure. what if someone's account was listed for 24 hours, and then the leak was taken down. they might still wish to know they were exposed, so they can take action. also, is the resource you're linking to confirmed as related to a known/verified data breach? who confirmed that this was a real breach of security? are you a first responder to the leak? has the leak been responsibly disclosed to the providers of the accounts tied to the leaked passwords?
- pixl97 11y ago> There's nothing to prevent people from posting arbitrary e-mail lists to pastebin, with purported matching passwords Your password is: xttp://someporn.site.the/spammer_wants_you_to_visit
- julianj 11y agoThat's true. I would need to refine my regex. I guess anyone with a password that contains http:// http:// or <script> or some other nastiness would be SOL. :)
- josu 11y agoOn a related note, how safe is it to do a Google search of your password?
- knd775 11y agoThis is actually a really interesting idea. I'd love to know how possible it would be for someone to scrape recent google searches, somehow. I'd think it would be relatively safe, but I'm still hesitant.
- chadzawistowski 11y agoProbably safe enough if you've just changed it.
- tripzilch 11y agoBeautiful effort, nice work! If you're going to continue doing this, you might want to take a look at the message you're sending (or have someone else do that for you). Remember that a large segment of your recipients are probably not the most tech-savvy (or brightest). Do not overestimate random users reading comprehension. Without clear explanation where these passwords came from the natural assumption is that you did it, and you're warning them as a threat. No that doesn't make sense but remember who you're talking to. One more thing: > the person indicated that they use the same password for everything and wanted to know which account had been compromised. If you answered that, you may just have got social engineered.