26 ms·

Online Cheating Site AshleyMadison Hacked

208 points by albedoa 11y ago

tenpoundhammer 11y ago
The possibilities are endless, I imagine someone will make this data easily searchable and journalists will be digging through to found anyone of notoriety that was dumb enough to sign up with their own names and credit cards etc. This hack could create a ton of news stories, including record divorce rates. I'm curious as to how the ashley madison admins are killing these links? DMCA takedowns? What's the mechanism for this?
- cft 11y ago
  You can actually submit any bogus name and address when you pay with a credit card- in most cases, the payment will go through if the zip and CVV match. Most carders know this, but the honest costomers do not...
  - cdcarter 11y ago
    You don't always need the CVV. A lot of processors will be fine with card number, expiry, zipcode, and the street number of your address. Sometimes I try giving wrong information to see what will happen. Usually, it works.
    - icelancer 11y ago
      Stripe makes CVV collection optional, for sure.
      - kalleboo 11y ago
        PayPal Website Payments Pro lets you opt out of address verification at least (can't remember if CVV is an option as well but I think so)
- steve19 11y ago
  ... or worse, use somebody else's name and create a realistic profile (do these sites have profiles?) that makes it look like the person you are impersonating.
- cheald 11y ago
  There's another case to be considered here, too - people who have used the site, got caught/came clean, did the work to fix it and have rescued their marriages (or were doing it with the blessing of their spouse), and now are at risk for their name being published for viewing by their coworkers, neighbors, members of their church, etc as a "cheater", "adulterer", etc, even after they've ostensibly paid their moral debt. There are certainly a lot of karma coming to a lot of people who deserve it, but there's also a lot of hurt coming to people who probably don't. An unrelated thought: I can only imagine how giddy the staff over at Gawker must be right now. This is like the David Geithner story times 37 million.
  - Asbostos 11y ago
    If your friends or coworkers abuse you because of their beliefs, then they are the ones causing harm, not the person who informed them. You sound like you're not giving full blame to those abusers or at least accepting that their behavior is inevitable. If you're a member of a church which abuses adulterers, and you don't think adulterers should be abused, then you're as much to blame by supporting that stance with your membership.
    - cheald 11y ago
      I am ruminating on the harm to be had here, not the moral culpability for it; it's easy to not be sympathetic here because these are by design people who occupy the moral low ground, but I can think of a few cases off the top of my head where this could cause real unwarranted harm to peoples' lives. Improperly applied, this could be as damaging as membership on the sex offenders' list for public urination. The fact that the people passing judgment are the ones imputing harm doesn't really change the fact that there are people whose lives will be damaged disproportionate to their crime, and I think that's extremely unfortunate. Edit: I can't recommend it as a literary work, but the themes and lessons of Hawthorne's "The Scarlet Letter" are directly and immediately relevant here.
    - reitzensteinm 11y ago
      I think you're making the mistake of treating blame in this instance as though it has to add up to 100%, and blame on one party lessens it on another. If my friend's dad hates gays, I tell him his son is gay knowing it's likely to cause violence, then the father and I are both total pieces of shit. His guilt does not absolve me in the least.
sandycheeks 11y ago
Most private investigators must be spending their Sunday night trying to get everything they can on this. They can and will make money on this data. EDIT: Spelling
- cowpewter 11y ago
  Most private investigators make all their money gathering evidence on worker's comp fraudsters for big insurance companies. My dad's been a licensed PI for over 25 years now and domestic cases are few and far between (maybe 1-2 per year) because Mrs Smith pissed off about her cheating husband doesn't have the cash that Bigco Insurance does and PIs charge by the hour. The insurance company has the cost of hiring a PI for 3-4 days so they can win fraud suits with the video evidence built into their cost structure. Unless the payout from a prenup is really big, it's not going to be worth hiring a PI to follow your husband around after work for a week. (Sidenote: If you're ever dumb enough to try to commit worker's comp fraud, you'd better keep up the act everywhere. Don't limp pathetically to and from your car at the doctor's office, then get home and work on your car or jump on the trampoline you have in your backyard. True story.)
  - Lawtonfogle 11y ago
    As to the sidenote, it must suck for the people who have periodic pain bad enough for them to be unable to hold a manual labor job but who can still have bouts of living a normal life. Either they have to forgo the moments of freedom they receive or risk losing any disability.
    - cowpewter 11y ago
      Eh, it's not longterm disability cases that the insurance companies hire PIs on. Hiring a PI is expensive. The insurance companies don't do it until they are already positive the person is defrauding them. The percentage of cases my dad's worked where the claimant was not very obviously faking is vanishingly small. Like less than 0.5%. By the time the PI is involved, the insurance company is already ready to sue, they just want extra evidence to solidify their case. They're nearly all acute injury cases - "I slipped and fell at work, and now my back's out and I can't work for six months" and they hobble their way into the doctor's office leaning on a cane when less than an hour ago they were doing heavy yard work (or jumping on said trampoline!) with no difficulty. Believe me, I have sympathy for people with chronic pain/invisible illnesses. I have fibromyalgia, my mom has myasthenia gravis. We are not the kind of people that wind up with PIs following them around with a camera.
ocfx 11y ago
Good. I hope the company goes bankrupt. People murder other people and kill themselves over shit like this.
- straik 11y ago
  I can´t see anything good in taking the company down. People are cheating, they always did. It's not illegal, they made a personal decision. Why is it a bad thing to run a platform for these people?
  - deleted 11y ago
    [deleted]
  - ocfx 11y ago
    Because it encourages the behavior and even makes it seem socially acceptable to some degree when it isn't.
  - ArtDev 11y ago
    The ads.
- drdeca 11y ago
  While I'm not sure that I agree, I /certainly/ am not sure that I disagree! I think the question of whether the hacking done was ethical is probably nontrivial.
- philwelch 11y ago
  People who commit murder and suicide over their insecurities and jealousies are responsible for their own actions.
  - pyre 11y ago
    How is this any different than creating a site that is a "marketplace" for cheating on your tests/essays/whatever in University? The cheaters are responsible for their own actions, right?
beedogs 11y ago
It couldn't have happened to a more deserving site.
- simplexion 11y ago
  Why is it deserving of this? Genuinely interested.
  - Asbostos 11y ago
    Cheating can cause a lot of emotional harm. Imagine a site for people to commit minor sexual assaults and publish the pictures of the victims. That would be easier to think of as deserving of being hacked though neither is causing tangible physical harm. The article also gives the reason that they apparently falsely sold customers a "delete your information" fee without actually deleting it. That kind of fraud can only really be exposed by hacking or whistleblowing.
    - simplexion 11y ago
      No. You are publishing pictures of someone without their permission. That is not the same.
      - Asbostos 11y ago
        Wouldn't you say the nature of the consequences are the same - emotional harm? Although you might judge the degree of harm differently. What problem can publishing pictures of assault cause the victim that doesn't happen with cheating?
    - sneak 11y ago
      Cheating is legal. Publishing people's PII is not.
      - Asbostos 11y ago
        Being illegal doesn't necessarily make is more wrong. Those laws are quite peculiar to this time and country. You could say that the laws in a democracy reflect what the people feel is right and wrong, but only on a very coarse level. There are bound to be laws that the majority disagrees with, as well as actions which people agree are wrong but individual cases are so complicated the law wouldn't really be able to handle them, so they're allowed.
Animats 11y ago
Waiting for the names of politicians with accounts to appear in the press.
barbs 11y ago
Where was the information published? Couldn't find it anywhere...
- Gustomaximus 11y ago
  Haha, I'm going to be very tempted to cross reference the data to my personal contacts if this information goes public. It's probably better not to know as many friends you know the partner also and it could put yourself in an awkward position.
miesman 11y ago
Perhaps it's a weakness on my part but it's difficult for me to see this as anything other than karma
heimatau 11y ago
So much for this. "AshleyMadison has become the last truly secure space on the Internet." - AM's PR team. Source: https://www.facebook.com/photo.php?fbid=10153447889029655 https://www.facebook.com/photo.php?fbid=10153447889029655
MertsA 11y ago
Not too surprising. Security in the past has been worse than abysmal on that site. I had a friend that jokingly made an account and sent me a link to his profile. However, that link was also his entire session. Once in the profile section it would let you change the password without knowing the current password. And the last kicker, the change password box had asterisks in it on page load and a quick "view source" revealed my friend's "not joking" password all from a link that didn't look too important. In summary: 1. Having a session id just stored in a GET variable for (most?) pages. 2. Use of http on profile edit page. 3. Allowing password change without reauthentication 4. Storing of all passwords without any form of hashing. 5. Sending passwords over http every time the profile edit page was viewed 6. Very easy for a user to accidentally share confidential data. I want to say this was back in 2008 and the site was launched in 2001. I can't imagine that they are making any of these mistakes today but if the past incompetence has any relevance then this security disaster was a long time in the making.
- mcphage 11y ago
  > I had a friend that jokingly made an account "a friend"
  - MertsA 11y ago
    Had it not been a friend I would have assumed as he did that the session id wasn't just slapped in the URL. What was great was when I sent him back "f1reball" and nothing else and he didn't believe that I could have possibly gotten that from the link he sent me.
- larrywright 11y ago
  I have a common gmail address, and as a result, it frequently gets used to sign up for things by people who are confused about their email address. In particular, there's a guy in South Carolina who signs up for adult hookup/dating sites using my email address. Very frequently I get emails with links in them that allow me, without any authentication, to change passwords, bios, etc. All that to say, I think this is quite common. I frequently use this to my advantage to do things like remove my email address, deactivate accounts, or change the bio to "you shouldn't sleep with me, I can't even remember my own email address."
Gustomaximus 11y ago
Does anyone know if it would it be illegal to look at and/or download this information once it is publicly available? I guess this would vary by country a bit. Would this count as 'possession of stolen goods' type thing? Seems likely, though catching people or having the will to is another thing.
- dogma1138 11y ago
  Illegal, also once you've compiled a data base of PII the laws governing personal information apply to you so you can be screwed from both ways.
  - lawnchair_larry 11y ago
    So it's illegal to copy the phone book or class graduation lists?
    - dogma1138 11y ago
      Yes copying them is copyright infringement, if you build them from source yourself then the rules governing PII apply.
      - koenigdavidmj 11y ago
        Phone books are not copyrightable. https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._Rural_Telephone_Service_Co https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._R....
        dogma1138 11y ago
        In the US maybe not, in Australia Telstra had copyright on the information in yellow and white pages till 2010, in the UK it's still protected by copyright as far as i know. UK Law: "original non-literary written work, eg software, web content and databases" Seems like the BT phone directory isn't protected however the database of yellow pages is still protected.
deleted 11y ago
[deleted]
cm2187 11y ago
Another nail in the coffin of the confidence in the IT industry. It starts to look more like a porcupine than a coffin now.
- Gigablah 11y ago
  Your purview of the "IT industry" is pretty narrow.
  - cm2187 11y ago
    Well, does it matter to the end user whether it is a flash or OpenSSL vulnerability, a sql injection vulnerability, a weak password or simply a careless employee who didn't check the URL before entering a password? It is a long chain in which every single link has shown to be weak so far.
    - ionised 11y ago
      You're talking about network security, which is a very small subset of IT.
Jugurtha 11y ago
As much as I admire and respect the United States and its people, I can't be but amazed by the reactions to sex stories. I have the impression that you can get away with anything, except sex. You can get away with incompetence, dilapidating tax payers' money, corruption, invasion of privacy, aggression on sovereign countries, authorizing torture, brutality, injustice. Big deal. Few care, and if they do, there are no consequences and no appologies. But God help you if your sex life is slightly different than what people say should someone's sex life be, it's the end of the world. I found the whole Tiger Woods thing to be incredibly stupid. Appologizing to people you don't know because you slept with someone else than your wife. How exactly did several million people became part of the family? I don't know why, but sex seems to be such a big deal in the U.S. media. You can shift the country's attention from something really important because the President enjoyed oral sex. Nevermind recording a conversation you're having with your friend. Really.. How important is it to the nation which person is the President having sex with? It puts important things (like "Is he doing his job well?") to the background. "He's utterly incompetent, but he's never cheated on his wife and he's good people". Why would I care if he's having orgies if he's doing the job he was elected to do: doing everything for the interest of the people and the country. Petraeus comes to mind, too. I mean a four-star General. Highly decorated. Going down for an extra-marrital affair. Seriously? Everything else he's done has the same weight and importance as "this"? The only thing it should have impact on is his family life, why should his career and public image suffer? Isn't this invasion of privacy from the public? And if we can tolerate this, shouldn't we tolerate that the Government spies on us and exposes what we do, in the media. Your dirtiest little secrets. How come this phoniness and hypocrisy goes accepted? Politicians boasting "family values" shaming others for cheating while they themselves cheat. Boasting "family values" as an argument against same-sex marriage while you cheat on your husband/wife?. People pulling religion and abstinence stunts only to be discovered to be human after all and enjoying someone's body from time to time... Why can this be used as ammunition by people who do it themselves, and how can the public opinion fall for these shaming campaigns by people who aren't clean from them. How come whenever it's about cheating, it's mostly the men politician? Do you mean women don't cheat? I simply don't understand how a country as developed as the U.S. can have the priorities organized in such an interesting way: 1- What X's sex life. 2-Everything else. Is it normal that people behave like 5 year olds seeing a vagina for the first time.
ulrikrasmussen 11y ago
I see a few comments sympathizing with the vigilantes behind this, implying that the exposed users had it coming. I am a bit sickened by this attitude, for several reasons. First of all, adultery is not illegal in the countries where most users of AshleyMadison are presumably residing, and even if it were, people could have used fake names which could implicate someone not actually associated with the site. This could destroy lives! Second, performing your own vigilante punishment by outing people who you feel are not living up to your own personal moral standards has no place in a developed society. It is not your right to destroy a family, not to mention one where every member is a stranger to you, by outing one of its members as a cheater and at the same time putting all other members of the family on public display.
- mdip 11y ago
  My only concern is for those who's credit card information was used illegally. If I were an employer, I'd be concerned about hiring someone who joined this site. Most jobs put people in a position where they could "get away" with theft or other illegal activities that could deeply harm the company and I can see employers being very concerned about hiring someone associated with the site. Those folks just had their lives ruined -- even when they manage to prove to the banks that the activity was illegal, they're now associated with this for life. As for the "real users". I don't think the lack of sympathy stems from people's misunderstanding that extramarital affairs are not "illegal". Most marriages have an expectation of monogamy and most users of this site were doing so in order to enjoy that activity without getting caught. They were the ones who decided to engage in an activity that broke up their family and "destroyed lives". This just sped up the process of getting caught. Aside from the moral contract that was broken, the cheating spouse also exposed their partner to sexually transmitted diseases without their knowledge. I think sites like this are despicable and people using them should expect that a site that caters to helping you "get away with things" is not a trustworthy place to do business. They actually charged $19 to have your profile "completely removed" and then didn't do what was paid for. I don't condone "vigilante punishment" and a read of the comments seems focused more on the activities of the users than the condoning of how they were caught, but I completely understand the lack of sympathy. I doubt you'd see such a lack of sympathy if the site catered to helping individuals escape addiction or cope with mental illness -- where a similar desire for anonymity exists. Two wrongs don't make a right, yes, but expecting the average married person to have a lot of sympathy for a site that caters to weak people who'd rather destroy their marriage than figure out how to be a good wife, husband, father or mother is a stretch. There are many corners of the internet that make a huge profit catering to vice that is not illegal but getting caught doing these things would have consequences outside of the law. Users engaged in that activity are choosing to accept the consequences and folks investing in sites like this need to fully understand that the site has a big red target on their back; it will probably be attacked successfully at some point in the future. As an aside, why is it assumed that all cheaters are men? The "vigilantes" frustrated me most with the comment Too bad for those men, they’re cheating dirtbags and deserve no such discretion. Anecdotally, I know of several relationships broken up by infidelity. I doubt I'm alone, it seems to be the main reason that my friends' marriages end in divorce -- people don't like to be alone so rather than end their marriage, attempt to mature and figure out why they were so unhappy, they jump to another partner and start off a new relationship with no trust as the foundation. In my small dataset, almost all of the affairs were had by women.
duncan_bayne 11y ago
The one group of people for whom I feel exactly no sympathy in all of this is the owners, investors and employees of AshleyMadison. Anyone who creates a site specifically to encourage and facilitate adultery deserves everything he or she gets.
- ChiperSoft 11y ago
  If they didn't provide it, someone else would (and do). Like it or not, there is a demand for those sites.
  - duncan_bayne 11y ago
    Sure, but do those facts alter the (im)morality of their behavior?
    - cozuya 11y ago
      Judge not?
      - itistoday2 11y ago
        Judge not Hitler, lest you be judged for your poorly prepared pancakes.
- jarman 11y ago
  I don't have problem with 'encourage and facilitate' - blame lies 100% on one committing adultery. But they deserve being hunted down by lynch mob of defrauded cheaters for that removal fee extortion.
  - duncan_bayne 11y ago
    How does that work? If I sell you a gun knowing you're going to commit murder with it, am I not also morally culpable?
JohnTHaller 11y ago
Krebs is down again, so here's a link to the Washington Post coverage: http://www.washingtonpost.com/news/morning-mix/wp/2015/07/20/online-cheaters-exposed-after-hackers-access-ashleymadison-hookup-site/ http://www.washingtonpost.com/news/morning-mix/wp/2015/07/20... TL;DR: Hackers took basically all data from cheating site AshleyMadison.com and what the hackers claim is a human trafficing/prostitution site EstablishedMen.com, have released some of real names/addresses/photos/profiles, and are threatening to release all 37 million personal records if the company doesn't take both sites offline.
rbanffy 11y ago
Engadget has some coverage too http://www.engadget.com/2015/07/20/ashley-madison-hack/ http://www.engadget.com/2015/07/20/ashley-madison-hack/
joeevans1000 11y ago
Apparently, there is data from all around the world. I hope it's realized that some countries punish cheating by corporal punishment or worse. If the data is published, I hope the data of users from those countries are removed.
amyjess 11y ago
Krebs has a bunch of information on this: http://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/ http://krebsonsecurity.com/2015/07/online-cheating-site-ashl... It's recently been updated with a statement by ALM.
markgavalda 11y ago
Let the bitcoin extortion begin... :-/
- stephengillie 11y ago
  Would it be better if the extortion were in Euros or Yen?
  - mahouse 11y ago
    Who would be so stupid to try and extort people using those currencies?
    - tinkerrr 11y ago
      Extortion predates Bitcoin
      - deleted 11y ago
        [deleted]
    - TillE 11y ago
      Well to start with, the Italian mafia and the Yakuza, respectively.
      - tedunangst 11y ago
        You missed the currency joke.
  - drzaiusapelord 11y ago
    No, because it would be a lot more traceable. Why do you think cryptolocker and its variants are suddenly popular. Bitcoin's relative anonymity allows it.
- jgrowl 11y ago
  This is good for bitcoin!
rm_-rf_slash 11y ago
If you're going to cheat, expect to be caught. If your search for sex involves putting any personal information online, definitely expect to be caught. If you don't want to be caught, be careful, use pseudonyms, and protect yourself from tracking. Or just ask for a divorce.
- noir_lord 11y ago
  There is a third option which is don't cheat. I've never done it but my last long term relationship ended with her doing it, things hadn't been good for a while. Ironically a year out I think her cheating made things easier for me (knowing there was zero way back makes a clean break simpler). I'd never cheat on anyone, I'd end things first no matter the circumstances.
  - obstacle1 11y ago
    The person you are responding to explicitly said: >If you're going to cheat Given that you are going to cheat, no, "don't cheat" is not an option.
  - spacemanmatt 11y ago
    You can say that on an individual basis but it doesn't change the aggregate behavior of our kind.
    - noir_lord 11y ago
      Very true but I still like to be able to look in the mirror and be happy with the person looking back. In a sense that's all you can do.
      - spacemanmatt 11y ago
        I gotta be able to respect the guy in the mirror, too. But there's a bit more I can do.
- spacemanmatt 11y ago
kendallpark 11y ago
What a blow for this company. What is the more ethical decision for a company in an ethically questionable business: shutting down the site and letting the hackers have their way, or allowing the hackers to release tons of private data? I feel a class action law suit on its way...
- tedunangst 11y ago
  Hire assassins to kill the hackers.
  - kendallpark 11y ago
    Two wrongs don't make a right, but three do!
    - CapitalistCartr 11y ago
      Three lefts do.
    - spacemanmatt 11y ago
      *three lefts do
- thedudemabry 11y ago
  Yeah, I have to imagine that this company (or at least its current brand incarnation) is done. The primary thing that they're selling is discretion. That trust can't be rebuilt.
smpetrey 11y ago
https://twitter.com/ftrain/status/623095490226159616 https://twitter.com/ftrain/status/623095490226159616
- deleted 11y ago
  [deleted]
- NullCharacter 11y ago
  How is full name, address, credit card information, and private pictures and messages considered "just metadata"? Nothing about that is metadata.
  - acqq 11y ago
    Imagine private pictures and messages not published. Then, full name, address and credit card information are actually "just" metadata, by the definition we've often heard from the officials. And publishing that is more than enough for those involved to really worry, that's the idea behind the message. Moreover, the article states "the company didn’t provide information on how much data might have been compromised." Where did you get the info that private pictures and messages are available?
    - NullCharacter 11y ago
      I might be able to bite on full name/address (considering it's what you'd see on an envelope) but the context is important. The fact that Person A sent a letter to Person B on this can be considered "just" metadata. But certainly CC information couldn't be classified as such, and again, context is important.
      - acqq 11y ago
        The context is what the message is all about. Just the presence of the names on the given site is enough. And can you please quote how you know that the private messages and pictures are to be published too?
curiousjorge 11y ago
the company was “working diligently and feverishly” to take down ALM’s intellectual property. I don't think the CEO understands how extortion works on the internet. If anything, their failure to protect it's users will result in a lot of divorces and sad kids. Even people who probably signed up out of curiosity is going to have a tough time explaining it to their spouses. The only option here is to shut down AM, but that seems unlikely given their history. CEO thinks it's an inside job boy we've heard this line over and over after a massive leak. Hacking Team used it. Sony used it. It's not even taken seriously anymore. If a former employer is being scapegoated, he's about to make serious bank by suing his employer. There's no way to prove or even attempting to question him would immediately be liable for defamation. If it is true that "powerful and rich people" are now going to have to divorce, give up have of their wealth to their spouse, I think ALM has bigger things to worry about in the form of class action lawsuits. The only outcome that makes sense is for AM to shut down.
jdalgetty 11y ago
It get's me that so many people are basically saying it serves these people right for using the service. I don't think that it matters that this is a "cheating" site, your privacy should still be guarded and it's not fair that all these people are being exposed. Secondly, I'd wager that many of the users sign up to use Ashley Madison for the thrill of the idea and probably aren't actually cheaters themselves or hooking up with other cheaters. A lot of the users are probably into the idea of roll playing or something similar. It's just too bad because I think due to the nature of the site a lot of people's private information is going to be leaked because this hacking group thinks they are doing something righteous and justified.
- jessriedel 11y ago
  All parties involved can be at fault. And lots of people will think that privacy, while very important, is not quite at the same level as marital fidelity. It's like hearing that a vicious murderous mob boss had his leg shot off. Yes, the person who took his leg ought to be sent to jail, but we might not have much sympathy for the mob boss since his terrible actions led directly to those consequences.
  - anotherangrydev 11y ago
    Typical. Free speech! (Until I hear something I don't like!) Equal rights! (Except for people that are not like me!)
    - jaawn 11y ago
      I don't think this argument really applies. It would be one thing if the site was devoted to assisting "open relationships," but it isn't. It is specifically a service to assist people in "cheating" on their partners (with the assumption being that the partners don't know and wouldn't approve). So, because of this specific detail, I don't think the "people not like me should be treated equally!" argument applies. The betrayal is intrinsic, not a matter of opinion.
      - 11y ago
dummy7953 11y ago
Someone's getting a divorce for Xmas!
deleted 11y ago
[deleted]
MeNotMe 11y ago
Two points: 1. Encrypt all database data, decrypt in application. 2. If you only do perimeter defense, you're doing it wrong.
- someDevOrOther 11y ago
  Regarding the first point, how would that help? The password has to be stored in the clear on the server. If an adversary got control of the box, then the adversary would get the password. And secondly, how would you search a database full of encrypted data? Homomorphic encryption isn't ready for prime time as I understand it.
  - MeNotMe 11y ago
    1. It's much easier to compromise a DB into a dump with injection, insufficient access control etc. than dump the db, find out it's encrypted, then hack the app servers and find a key somewhere in the binary. 2. You can use key distribution schemes to the app servers. 3. If you need to 'live' search in personal data you're doing it wrong. You can move search to a fulltext engine for the stuff you really need, which is more difficult to dump and reassemble. E.g. if you search for city, you only have primary keys and cities in one system. 4. You should also not keep profiles, personal data and other data on one server. Compromising one of the access paths will compromise all your data.
coldcode 11y ago
People get hacked all the time but the data these folks failed to defend is almost as bad as what the Feds lost. You can always repair your credit, get new cards, even replace your money but you can never ever get back your reputation or your family or the respect of others if you lose that. But giving such a site this type of information (even if you were only curious) is just asking for it to become public. The consequences can range from embarrassment to divorce to losing children or even getting murdered. Whatever the thrill it's not worth the risk. I don't know how to implement such a thing, but failing to protect people's information seems like it should be prosecutable. Maybe it's an impossibility but I don't know how else to make people care about protecting private information.
- jaawn 11y ago
  I think we've learned over the years that perfection is an unrealistic goal when it comes to data security. We should still strive for better and better methods of securing data, but I think we should also try to change our expectations. When putting any information on the internet, it should be assumed that there is a decent risk of that information being discovered (regardless of security measures involved). We need to plan accordingly. In this case, if discovery and release of the data would be something you don't think you could recover from, I think that is a good indication that maybe the data is associated with something that isn't worth doing.
- mikegioia 11y ago
  This is insane, you're saying Ashley Madison should be prosecuted for having their data hacked? Do you have any idea what that means for the rest of the world's websites? And to even make a claim that this is somehow worse than the massively private information the Feds lost is laughable. Do you know what data AM had on its users? Do you think it's even remotely close to the data the Feds had on every single public sector employee in the US? Should the US be prosecuted for losing that data? Should I be prosecuted because my site got hacked through a 0-day? Should KVM be sued for a bug that allowed for that hack? Should Linode since they're the data center? No, no one should be sued. If you want people to wake up about their private information, then prosecuting the sites is in no way going to achieve that. How about people themselves are the ones in the wrong for cheating, and not a website that makes it easier. This is akin to blaming and banning alcohol because someone drove drunk.
sp332 11y ago
https://twitter.com/PreachySnow/ https://twitter.com/PreachySnow/ > Do you know what some men do when they find out their wives have been cheating? They beat them. They kill them. They don't just leave. Also, users of Ashley Madison could lose their jobs. You know, their support system that allows them to take care of their kids. Millions of people being revealed for committing adultery isn't anything to rejoice about. This is not the way to handle such a situation.
- caskance 11y ago
  And when that happens, it is the man's fault for reacting violently, or if you're particularly callous, the wife's fault for cheating. The person who reveals the truth is quite a ways down the blame list.
  - sp332 11y ago
    It's certainly the abuser's fault. But if you can avoid the situation by literally doing nothing (not leaking the info) then you might have a moral responsibility if you do it. And a lot of people think leaking would be a good thing, but they generally only think of breakups and don't consider violence.
    - caskance 11y ago
      That kind of cowardly pseudoreasoning allows those who are willing to threaten violence to get whatever they want effortlessly.
      - sp332 11y ago
        These are the two points: 1. Millions of people being revealed for committing adultery isn't anything to rejoice about. 2. This is not the way to handle such a situation. Neither of these are cowardly, and neither of these give anything to people threatening violence. Outing someone to their abusive partner is clearly morally wrong.
- killface 11y ago
jpredham 11y ago
Also worth noting is the continuing evolution of the motivations behind hacks. The impact team made a seemingly moral (subjectively, not objectively moral, of course) when they could have likely blackmailed these users for money or influence. It's interesting to try to guess how these factions, each occupying some point on the political/idealogical grid, are going to look like in 10 years. My guess would be that we begin to see more competition between them as well as an increase in internal organizational structure.
ArtDev 11y ago
I may not like the idea of the site, but it wasn't until I started seeings ads for it, that I started hoping for its downfall. My wish was granted!
- ArtDev 11y ago
  Here is a banner ad I am referring to: http://thehairpin.com/wp-content/uploads/sites/3/2011/04/1-74-percent-affair.jpg http://thehairpin.com/wp-content/uploads/sites/3/2011/04/1-7...
  - rue 11y ago
    Me, I have an adblocker and let other people do what they want to do.
evandrix 11y ago
so where's the leak @? .torrent / pastebin ?
jjuhl 11y ago
I don't get why people get so worked up over this. Yes, people have afairs; so what? It's fun and everyone likes to have a bit of harmless sex with new people once in a while. No big deal.
emmapersky 11y ago
It seems that no one is making the distinction between actually having an affair and simply the fantasy of it that most of these members probably engage in. I would guess that of those 40m members only a small handful have ever engaged in an affair through the site.
fapjacks 11y ago
Cross-referencing the dump from this hack with the OPM dump containing a list of everyone with TS/SCI clearance... Now that is a very handy bit of information.
killface 11y ago
Assholes attacking other assholes online? Meh, I'm not going to lose any sleep over it. Some of them will get what they deserve (personal opinion, of course), on both sides.
flippinburgers 11y ago
Cheating is not cool, but acting like all of the users of that site "deserve it" is such a horrendous broad stroke. It just reeks of White Knight BS. Every last person on earth struggles with balancing their own inner desires against the expectations of the society around them. Some are better at this than others. I'm glad some of you are such perfect little angels that you feel that wrecking other peoples live is ok. I've been cheated on before. It was fucking god awful but I wouldn't expect that the other person's life be destroyed as a result. Relationships are WAY more complex than some holier-than-thou promise that people make to one another.

208 points by albedoa 11y ago

The possibilities are endless, I imagine someone will make this data easily searchable and journalists will be digging through to found anyone of notoriety that was dumb enough to sign up with their own names and credit cards etc. This hack could create a ton of news stories, including record divorce rates. I'm curious as to how the ashley madison admins are killing these links? DMCA takedowns? What's the mechanism for this?

cft 11y ago
You can actually submit any bogus name and address when you pay with a credit card- in most cases, the payment will go through if the zip and CVV match. Most carders know this, but the honest costomers do not...
- cdcarter 11y ago
  You don't always need the CVV. A lot of processors will be fine with card number, expiry, zipcode, and the street number of your address. Sometimes I try giving wrong information to see what will happen. Usually, it works.
  - icelancer 11y ago
    Stripe makes CVV collection optional, for sure.
    - kalleboo 11y ago
      PayPal Website Payments Pro lets you opt out of address verification at least (can't remember if CVV is an option as well but I think so)
steve19 11y ago
... or worse, use somebody else's name and create a realistic profile (do these sites have profiles?) that makes it look like the person you are impersonating.
cheald 11y ago
There's another case to be considered here, too - people who have used the site, got caught/came clean, did the work to fix it and have rescued their marriages (or were doing it with the blessing of their spouse), and now are at risk for their name being published for viewing by their coworkers, neighbors, members of their church, etc as a "cheater", "adulterer", etc, even after they've ostensibly paid their moral debt. There are certainly a lot of karma coming to a lot of people who deserve it, but there's also a lot of hurt coming to people who probably don't. An unrelated thought: I can only imagine how giddy the staff over at Gawker must be right now. This is like the David Geithner story times 37 million.
- Asbostos 11y ago
  If your friends or coworkers abuse you because of their beliefs, then they are the ones causing harm, not the person who informed them. You sound like you're not giving full blame to those abusers or at least accepting that their behavior is inevitable. If you're a member of a church which abuses adulterers, and you don't think adulterers should be abused, then you're as much to blame by supporting that stance with your membership.
  - cheald 11y ago
    I am ruminating on the harm to be had here, not the moral culpability for it; it's easy to not be sympathetic here because these are by design people who occupy the moral low ground, but I can think of a few cases off the top of my head where this could cause real unwarranted harm to peoples' lives. Improperly applied, this could be as damaging as membership on the sex offenders' list for public urination. The fact that the people passing judgment are the ones imputing harm doesn't really change the fact that there are people whose lives will be damaged disproportionate to their crime, and I think that's extremely unfortunate. Edit: I can't recommend it as a literary work, but the themes and lessons of Hawthorne's "The Scarlet Letter" are directly and immediately relevant here.
  - reitzensteinm 11y ago
    I think you're making the mistake of treating blame in this instance as though it has to add up to 100%, and blame on one party lessens it on another. If my friend's dad hates gays, I tell him his son is gay knowing it's likely to cause violence, then the father and I are both total pieces of shit. His guilt does not absolve me in the least.

sandycheeks 11y ago

Most private investigators must be spending their Sunday night trying to get everything they can on this. They can and will make money on this data. EDIT: Spelling

cowpewter 11y ago
Most private investigators make all their money gathering evidence on worker's comp fraudsters for big insurance companies. My dad's been a licensed PI for over 25 years now and domestic cases are few and far between (maybe 1-2 per year) because Mrs Smith pissed off about her cheating husband doesn't have the cash that Bigco Insurance does and PIs charge by the hour. The insurance company has the cost of hiring a PI for 3-4 days so they can win fraud suits with the video evidence built into their cost structure. Unless the payout from a prenup is really big, it's not going to be worth hiring a PI to follow your husband around after work for a week. (Sidenote: If you're ever dumb enough to try to commit worker's comp fraud, you'd better keep up the act everywhere. Don't limp pathetically to and from your car at the doctor's office, then get home and work on your car or jump on the trampoline you have in your backyard. True story.)
- Lawtonfogle 11y ago
  As to the sidenote, it must suck for the people who have periodic pain bad enough for them to be unable to hold a manual labor job but who can still have bouts of living a normal life. Either they have to forgo the moments of freedom they receive or risk losing any disability.
  - cowpewter 11y ago
    Eh, it's not longterm disability cases that the insurance companies hire PIs on. Hiring a PI is expensive. The insurance companies don't do it until they are already positive the person is defrauding them. The percentage of cases my dad's worked where the claimant was not very obviously faking is vanishingly small. Like less than 0.5%. By the time the PI is involved, the insurance company is already ready to sue, they just want extra evidence to solidify their case. They're nearly all acute injury cases - "I slipped and fell at work, and now my back's out and I can't work for six months" and they hobble their way into the doctor's office leaning on a cane when less than an hour ago they were doing heavy yard work (or jumping on said trampoline!) with no difficulty. Believe me, I have sympathy for people with chronic pain/invisible illnesses. I have fibromyalgia, my mom has myasthenia gravis. We are not the kind of people that wind up with PIs following them around with a camera.

ocfx 11y ago

Good. I hope the company goes bankrupt. People murder other people and kill themselves over shit like this.

straik 11y ago
I can´t see anything good in taking the company down. People are cheating, they always did. It's not illegal, they made a personal decision. Why is it a bad thing to run a platform for these people?
- deleted 11y ago
  [deleted]
- ocfx 11y ago
  Because it encourages the behavior and even makes it seem socially acceptable to some degree when it isn't.
- ArtDev 11y ago
  The ads.
drdeca 11y ago
While I'm not sure that I agree, I /certainly/ am not sure that I disagree! I think the question of whether the hacking done was ethical is probably nontrivial.
philwelch 11y ago
People who commit murder and suicide over their insecurities and jealousies are responsible for their own actions.
- pyre 11y ago
  How is this any different than creating a site that is a "marketplace" for cheating on your tests/essays/whatever in University? The cheaters are responsible for their own actions, right?

beedogs 11y ago

It couldn't have happened to a more deserving site.

simplexion 11y ago
Why is it deserving of this? Genuinely interested.
- Asbostos 11y ago
  Cheating can cause a lot of emotional harm. Imagine a site for people to commit minor sexual assaults and publish the pictures of the victims. That would be easier to think of as deserving of being hacked though neither is causing tangible physical harm. The article also gives the reason that they apparently falsely sold customers a "delete your information" fee without actually deleting it. That kind of fraud can only really be exposed by hacking or whistleblowing.
  - simplexion 11y ago
    No. You are publishing pictures of someone without their permission. That is not the same.
    - Asbostos 11y ago
      Wouldn't you say the nature of the consequences are the same - emotional harm? Although you might judge the degree of harm differently. What problem can publishing pictures of assault cause the victim that doesn't happen with cheating?
  - sneak 11y ago
    Cheating is legal. Publishing people's PII is not.
    - Asbostos 11y ago
      Being illegal doesn't necessarily make is more wrong. Those laws are quite peculiar to this time and country. You could say that the laws in a democracy reflect what the people feel is right and wrong, but only on a very coarse level. There are bound to be laws that the majority disagrees with, as well as actions which people agree are wrong but individual cases are so complicated the law wouldn't really be able to handle them, so they're allowed.

Animats 11y ago

Waiting for the names of politicians with accounts to appear in the press.

barbs 11y ago

Where was the information published? Couldn't find it anywhere...

Gustomaximus 11y ago
Haha, I'm going to be very tempted to cross reference the data to my personal contacts if this information goes public. It's probably better not to know as many friends you know the partner also and it could put yourself in an awkward position.

miesman 11y ago

Perhaps it's a weakness on my part but it's difficult for me to see this as anything other than karma

heimatau 11y ago

So much for this. "AshleyMadison has become the last truly secure space on the Internet." - AM's PR team. Source: https://www.facebook.com/photo.php?fbid=10153447889029655 https://www.facebook.com/photo.php?fbid=10153447889029655

MertsA 11y ago

Not too surprising. Security in the past has been worse than abysmal on that site. I had a friend that jokingly made an account and sent me a link to his profile. However, that link was also his entire session. Once in the profile section it would let you change the password without knowing the current password. And the last kicker, the change password box had asterisks in it on page load and a quick "view source" revealed my friend's "not joking" password all from a link that didn't look too important. In summary: 1. Having a session id just stored in a GET variable for (most?) pages. 2. Use of http on profile edit page. 3. Allowing password change without reauthentication 4. Storing of all passwords without any form of hashing. 5. Sending passwords over http every time the profile edit page was viewed 6. Very easy for a user to accidentally share confidential data. I want to say this was back in 2008 and the site was launched in 2001. I can't imagine that they are making any of these mistakes today but if the past incompetence has any relevance then this security disaster was a long time in the making.

mcphage 11y ago
> I had a friend that jokingly made an account "a friend"
- MertsA 11y ago
  Had it not been a friend I would have assumed as he did that the session id wasn't just slapped in the URL. What was great was when I sent him back "f1reball" and nothing else and he didn't believe that I could have possibly gotten that from the link he sent me.
larrywright 11y ago
I have a common gmail address, and as a result, it frequently gets used to sign up for things by people who are confused about their email address. In particular, there's a guy in South Carolina who signs up for adult hookup/dating sites using my email address. Very frequently I get emails with links in them that allow me, without any authentication, to change passwords, bios, etc. All that to say, I think this is quite common. I frequently use this to my advantage to do things like remove my email address, deactivate accounts, or change the bio to "you shouldn't sleep with me, I can't even remember my own email address."

Gustomaximus 11y ago

Does anyone know if it would it be illegal to look at and/or download this information once it is publicly available? I guess this would vary by country a bit. Would this count as 'possession of stolen goods' type thing? Seems likely, though catching people or having the will to is another thing.

dogma1138 11y ago
Illegal, also once you've compiled a data base of PII the laws governing personal information apply to you so you can be screwed from both ways.
- lawnchair_larry 11y ago
  So it's illegal to copy the phone book or class graduation lists?
  - dogma1138 11y ago
    Yes copying them is copyright infringement, if you build them from source yourself then the rules governing PII apply.
    - koenigdavidmj 11y ago
      Phone books are not copyrightable. https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._Rural_Telephone_Service_Co https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._R....
      - dogma1138 11y ago
        In the US maybe not, in Australia Telstra had copyright on the information in yellow and white pages till 2010, in the UK it's still protected by copyright as far as i know. UK Law: "original non-literary written work, eg software, web content and databases" Seems like the BT phone directory isn't protected however the database of yellow pages is still protected.

deleted 11y ago

[deleted]

cm2187 11y ago

Another nail in the coffin of the confidence in the IT industry. It starts to look more like a porcupine than a coffin now.

Gigablah 11y ago
Your purview of the "IT industry" is pretty narrow.
- cm2187 11y ago
  Well, does it matter to the end user whether it is a flash or OpenSSL vulnerability, a sql injection vulnerability, a weak password or simply a careless employee who didn't check the URL before entering a password? It is a long chain in which every single link has shown to be weak so far.
  - ionised 11y ago
    You're talking about network security, which is a very small subset of IT.

Jugurtha 11y ago

As much as I admire and respect the United States and its people, I can't be but amazed by the reactions to sex stories. I have the impression that you can get away with anything, except sex. You can get away with incompetence, dilapidating tax payers' money, corruption, invasion of privacy, aggression on sovereign countries, authorizing torture, brutality, injustice. Big deal. Few care, and if they do, there are no consequences and no appologies. But God help you if your sex life is slightly different than what people say should someone's sex life be, it's the end of the world. I found the whole Tiger Woods thing to be incredibly stupid. Appologizing to people you don't know because you slept with someone else than your wife. How exactly did several million people became part of the family? I don't know why, but sex seems to be such a big deal in the U.S. media. You can shift the country's attention from something really important because the President enjoyed oral sex. Nevermind recording a conversation you're having with your friend. Really.. How important is it to the nation which person is the President having sex with? It puts important things (like "Is he doing his job well?") to the background. "He's utterly incompetent, but he's never cheated on his wife and he's good people". Why would I care if he's having orgies if he's doing the job he was elected to do: doing everything for the interest of the people and the country. Petraeus comes to mind, too. I mean a four-star General. Highly decorated. Going down for an extra-marrital affair. Seriously? Everything else he's done has the same weight and importance as "this"? The only thing it should have impact on is his family life, why should his career and public image suffer? Isn't this invasion of privacy from the public? And if we can tolerate this, shouldn't we tolerate that the Government spies on us and exposes what we do, in the media. Your dirtiest little secrets. How come this phoniness and hypocrisy goes accepted? Politicians boasting "family values" shaming others for cheating while they themselves cheat. Boasting "family values" as an argument against same-sex marriage while you cheat on your husband/wife?. People pulling religion and abstinence stunts only to be discovered to be human after all and enjoying someone's body from time to time... Why can this be used as ammunition by people who do it themselves, and how can the public opinion fall for these shaming campaigns by people who aren't clean from them. How come whenever it's about cheating, it's mostly the men politician? Do you mean women don't cheat? I simply don't understand how a country as developed as the U.S. can have the priorities organized in such an interesting way: 1- What X's sex life. 2-Everything else. Is it normal that people behave like 5 year olds seeing a vagina for the first time.

ulrikrasmussen 11y ago

I see a few comments sympathizing with the vigilantes behind this, implying that the exposed users had it coming. I am a bit sickened by this attitude, for several reasons. First of all, adultery is not illegal in the countries where most users of AshleyMadison are presumably residing, and even if it were, people could have used fake names which could implicate someone not actually associated with the site. This could destroy lives! Second, performing your own vigilante punishment by outing people who you feel are not living up to your own personal moral standards has no place in a developed society. It is not your right to destroy a family, not to mention one where every member is a stranger to you, by outing one of its members as a cheater and at the same time putting all other members of the family on public display.

mdip 11y ago
My only concern is for those who's credit card information was used illegally. If I were an employer, I'd be concerned about hiring someone who joined this site. Most jobs put people in a position where they could "get away" with theft or other illegal activities that could deeply harm the company and I can see employers being very concerned about hiring someone associated with the site. Those folks just had their lives ruined -- even when they manage to prove to the banks that the activity was illegal, they're now associated with this for life. As for the "real users". I don't think the lack of sympathy stems from people's misunderstanding that extramarital affairs are not "illegal". Most marriages have an expectation of monogamy and most users of this site were doing so in order to enjoy that activity without getting caught. They were the ones who decided to engage in an activity that broke up their family and "destroyed lives". This just sped up the process of getting caught. Aside from the moral contract that was broken, the cheating spouse also exposed their partner to sexually transmitted diseases without their knowledge. I think sites like this are despicable and people using them should expect that a site that caters to helping you "get away with things" is not a trustworthy place to do business. They actually charged $19 to have your profile "completely removed" and then didn't do what was paid for. I don't condone "vigilante punishment" and a read of the comments seems focused more on the activities of the users than the condoning of how they were caught, but I completely understand the lack of sympathy. I doubt you'd see such a lack of sympathy if the site catered to helping individuals escape addiction or cope with mental illness -- where a similar desire for anonymity exists. Two wrongs don't make a right, yes, but expecting the average married person to have a lot of sympathy for a site that caters to weak people who'd rather destroy their marriage than figure out how to be a good wife, husband, father or mother is a stretch. There are many corners of the internet that make a huge profit catering to vice that is not illegal but getting caught doing these things would have consequences outside of the law. Users engaged in that activity are choosing to accept the consequences and folks investing in sites like this need to fully understand that the site has a big red target on their back; it will probably be attacked successfully at some point in the future. As an aside, why is it assumed that all cheaters are men? The "vigilantes" frustrated me most with the comment Too bad for those men, they’re cheating dirtbags and deserve no such discretion. Anecdotally, I know of several relationships broken up by infidelity. I doubt I'm alone, it seems to be the main reason that my friends' marriages end in divorce -- people don't like to be alone so rather than end their marriage, attempt to mature and figure out why they were so unhappy, they jump to another partner and start off a new relationship with no trust as the foundation. In my small dataset, almost all of the affairs were had by women.

duncan_bayne 11y ago

The one group of people for whom I feel exactly no sympathy in all of this is the owners, investors and employees of AshleyMadison. Anyone who creates a site specifically to encourage and facilitate adultery deserves everything he or she gets.

ChiperSoft 11y ago
If they didn't provide it, someone else would (and do). Like it or not, there is a demand for those sites.
- duncan_bayne 11y ago
  Sure, but do those facts alter the (im)morality of their behavior?
  - cozuya 11y ago
    Judge not?
    - itistoday2 11y ago
      Judge not Hitler, lest you be judged for your poorly prepared pancakes.
jarman 11y ago
I don't have problem with 'encourage and facilitate' - blame lies 100% on one committing adultery. But they deserve being hunted down by lynch mob of defrauded cheaters for that removal fee extortion.
- duncan_bayne 11y ago
  How does that work? If I sell you a gun knowing you're going to commit murder with it, am I not also morally culpable?

JohnTHaller 11y ago

Krebs is down again, so here's a link to the Washington Post coverage: http://www.washingtonpost.com/news/morning-mix/wp/2015/07/20/online-cheaters-exposed-after-hackers-access-ashleymadison-hookup-site/ http://www.washingtonpost.com/news/morning-mix/wp/2015/07/20... TL;DR: Hackers took basically all data from cheating site AshleyMadison.com and what the hackers claim is a human trafficing/prostitution site EstablishedMen.com, have released some of real names/addresses/photos/profiles, and are threatening to release all 37 million personal records if the company doesn't take both sites offline.

rbanffy 11y ago

Engadget has some coverage too http://www.engadget.com/2015/07/20/ashley-madison-hack/ http://www.engadget.com/2015/07/20/ashley-madison-hack/

joeevans1000 11y ago

Apparently, there is data from all around the world. I hope it's realized that some countries punish cheating by corporal punishment or worse. If the data is published, I hope the data of users from those countries are removed.

amyjess 11y ago

Krebs has a bunch of information on this: http://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/ http://krebsonsecurity.com/2015/07/online-cheating-site-ashl... It's recently been updated with a statement by ALM.

markgavalda 11y ago

Let the bitcoin extortion begin... :-/

stephengillie 11y ago
Would it be better if the extortion were in Euros or Yen?
- mahouse 11y ago
  Who would be so stupid to try and extort people using those currencies?
  - tinkerrr 11y ago
    Extortion predates Bitcoin
    - deleted 11y ago
      [deleted]
  - TillE 11y ago
    Well to start with, the Italian mafia and the Yakuza, respectively.
    - tedunangst 11y ago
      You missed the currency joke.
- drzaiusapelord 11y ago
  No, because it would be a lot more traceable. Why do you think cryptolocker and its variants are suddenly popular. Bitcoin's relative anonymity allows it.
jgrowl 11y ago
This is good for bitcoin!

rm_-rf_slash 11y ago

If you're going to cheat, expect to be caught. If your search for sex involves putting any personal information online, definitely expect to be caught. If you don't want to be caught, be careful, use pseudonyms, and protect yourself from tracking. Or just ask for a divorce.

noir_lord 11y ago
There is a third option which is don't cheat. I've never done it but my last long term relationship ended with her doing it, things hadn't been good for a while. Ironically a year out I think her cheating made things easier for me (knowing there was zero way back makes a clean break simpler). I'd never cheat on anyone, I'd end things first no matter the circumstances.
- obstacle1 11y ago
  The person you are responding to explicitly said: >If you're going to cheat Given that you are going to cheat, no, "don't cheat" is not an option.
- spacemanmatt 11y ago
  You can say that on an individual basis but it doesn't change the aggregate behavior of our kind.
  - noir_lord 11y ago
    Very true but I still like to be able to look in the mirror and be happy with the person looking back. In a sense that's all you can do.
    - spacemanmatt 11y ago
      I gotta be able to respect the guy in the mirror, too. But there's a bit more I can do.
spacemanmatt 11y ago

kendallpark 11y ago

What a blow for this company. What is the more ethical decision for a company in an ethically questionable business: shutting down the site and letting the hackers have their way, or allowing the hackers to release tons of private data? I feel a class action law suit on its way...

tedunangst 11y ago
Hire assassins to kill the hackers.
- kendallpark 11y ago
  Two wrongs don't make a right, but three do!
  - CapitalistCartr 11y ago
    Three lefts do.
  - spacemanmatt 11y ago
    *three lefts do
thedudemabry 11y ago
Yeah, I have to imagine that this company (or at least its current brand incarnation) is done. The primary thing that they're selling is discretion. That trust can't be rebuilt.

smpetrey 11y ago

https://twitter.com/ftrain/status/623095490226159616 https://twitter.com/ftrain/status/623095490226159616

deleted 11y ago
[deleted]
NullCharacter 11y ago
How is full name, address, credit card information, and private pictures and messages considered "just metadata"? Nothing about that is metadata.
- acqq 11y ago
  Imagine private pictures and messages not published. Then, full name, address and credit card information are actually "just" metadata, by the definition we've often heard from the officials. And publishing that is more than enough for those involved to really worry, that's the idea behind the message. Moreover, the article states "the company didn’t provide information on how much data might have been compromised." Where did you get the info that private pictures and messages are available?
  - NullCharacter 11y ago
    I might be able to bite on full name/address (considering it's what you'd see on an envelope) but the context is important. The fact that Person A sent a letter to Person B on this can be considered "just" metadata. But certainly CC information couldn't be classified as such, and again, context is important.
    - acqq 11y ago
      The context is what the message is all about. Just the presence of the names on the given site is enough. And can you please quote how you know that the private messages and pictures are to be published too?

curiousjorge 11y ago

the company was “working diligently and feverishly” to take down ALM’s intellectual property. I don't think the CEO understands how extortion works on the internet. If anything, their failure to protect it's users will result in a lot of divorces and sad kids. Even people who probably signed up out of curiosity is going to have a tough time explaining it to their spouses. The only option here is to shut down AM, but that seems unlikely given their history. CEO thinks it's an inside job boy we've heard this line over and over after a massive leak. Hacking Team used it. Sony used it. It's not even taken seriously anymore. If a former employer is being scapegoated, he's about to make serious bank by suing his employer. There's no way to prove or even attempting to question him would immediately be liable for defamation. If it is true that "powerful and rich people" are now going to have to divorce, give up have of their wealth to their spouse, I think ALM has bigger things to worry about in the form of class action lawsuits. The only outcome that makes sense is for AM to shut down.

jdalgetty 11y ago

It get's me that so many people are basically saying it serves these people right for using the service. I don't think that it matters that this is a "cheating" site, your privacy should still be guarded and it's not fair that all these people are being exposed. Secondly, I'd wager that many of the users sign up to use Ashley Madison for the thrill of the idea and probably aren't actually cheaters themselves or hooking up with other cheaters. A lot of the users are probably into the idea of roll playing or something similar. It's just too bad because I think due to the nature of the site a lot of people's private information is going to be leaked because this hacking group thinks they are doing something righteous and justified.

jessriedel 11y ago
All parties involved can be at fault. And lots of people will think that privacy, while very important, is not quite at the same level as marital fidelity. It's like hearing that a vicious murderous mob boss had his leg shot off. Yes, the person who took his leg ought to be sent to jail, but we might not have much sympathy for the mob boss since his terrible actions led directly to those consequences.
- anotherangrydev 11y ago
  Typical. Free speech! (Until I hear something I don't like!) Equal rights! (Except for people that are not like me!)
  - jaawn 11y ago
    I don't think this argument really applies. It would be one thing if the site was devoted to assisting "open relationships," but it isn't. It is specifically a service to assist people in "cheating" on their partners (with the assumption being that the partners don't know and wouldn't approve). So, because of this specific detail, I don't think the "people not like me should be treated equally!" argument applies. The betrayal is intrinsic, not a matter of opinion.
    - 11y ago

dummy7953 11y ago

Someone's getting a divorce for Xmas!

deleted 11y ago

[deleted]

MeNotMe 11y ago

Two points: 1. Encrypt all database data, decrypt in application. 2. If you only do perimeter defense, you're doing it wrong.

someDevOrOther 11y ago
Regarding the first point, how would that help? The password has to be stored in the clear on the server. If an adversary got control of the box, then the adversary would get the password. And secondly, how would you search a database full of encrypted data? Homomorphic encryption isn't ready for prime time as I understand it.
- MeNotMe 11y ago
  1. It's much easier to compromise a DB into a dump with injection, insufficient access control etc. than dump the db, find out it's encrypted, then hack the app servers and find a key somewhere in the binary. 2. You can use key distribution schemes to the app servers. 3. If you need to 'live' search in personal data you're doing it wrong. You can move search to a fulltext engine for the stuff you really need, which is more difficult to dump and reassemble. E.g. if you search for city, you only have primary keys and cities in one system. 4. You should also not keep profiles, personal data and other data on one server. Compromising one of the access paths will compromise all your data.

coldcode 11y ago

People get hacked all the time but the data these folks failed to defend is almost as bad as what the Feds lost. You can always repair your credit, get new cards, even replace your money but you can never ever get back your reputation or your family or the respect of others if you lose that. But giving such a site this type of information (even if you were only curious) is just asking for it to become public. The consequences can range from embarrassment to divorce to losing children or even getting murdered. Whatever the thrill it's not worth the risk. I don't know how to implement such a thing, but failing to protect people's information seems like it should be prosecutable. Maybe it's an impossibility but I don't know how else to make people care about protecting private information.

jaawn 11y ago
I think we've learned over the years that perfection is an unrealistic goal when it comes to data security. We should still strive for better and better methods of securing data, but I think we should also try to change our expectations. When putting any information on the internet, it should be assumed that there is a decent risk of that information being discovered (regardless of security measures involved). We need to plan accordingly. In this case, if discovery and release of the data would be something you don't think you could recover from, I think that is a good indication that maybe the data is associated with something that isn't worth doing.
mikegioia 11y ago
This is insane, you're saying Ashley Madison should be prosecuted for having their data hacked? Do you have any idea what that means for the rest of the world's websites? And to even make a claim that this is somehow worse than the massively private information the Feds lost is laughable. Do you know what data AM had on its users? Do you think it's even remotely close to the data the Feds had on every single public sector employee in the US? Should the US be prosecuted for losing that data? Should I be prosecuted because my site got hacked through a 0-day? Should KVM be sued for a bug that allowed for that hack? Should Linode since they're the data center? No, no one should be sued. If you want people to wake up about their private information, then prosecuting the sites is in no way going to achieve that. How about people themselves are the ones in the wrong for cheating, and not a website that makes it easier. This is akin to blaming and banning alcohol because someone drove drunk.

sp332 11y ago

https://twitter.com/PreachySnow/ https://twitter.com/PreachySnow/ > Do you know what some men do when they find out their wives have been cheating? They beat them. They kill them. They don't just leave. Also, users of Ashley Madison could lose their jobs. You know, their support system that allows them to take care of their kids. Millions of people being revealed for committing adultery isn't anything to rejoice about. This is not the way to handle such a situation.

caskance 11y ago
And when that happens, it is the man's fault for reacting violently, or if you're particularly callous, the wife's fault for cheating. The person who reveals the truth is quite a ways down the blame list.
- sp332 11y ago
  It's certainly the abuser's fault. But if you can avoid the situation by literally doing nothing (not leaking the info) then you might have a moral responsibility if you do it. And a lot of people think leaking would be a good thing, but they generally only think of breakups and don't consider violence.
  - caskance 11y ago
    That kind of cowardly pseudoreasoning allows those who are willing to threaten violence to get whatever they want effortlessly.
    - sp332 11y ago
      These are the two points: 1. Millions of people being revealed for committing adultery isn't anything to rejoice about. 2. This is not the way to handle such a situation. Neither of these are cowardly, and neither of these give anything to people threatening violence. Outing someone to their abusive partner is clearly morally wrong.
killface 11y ago

jpredham 11y ago

Also worth noting is the continuing evolution of the motivations behind hacks. The impact team made a seemingly moral (subjectively, not objectively moral, of course) when they could have likely blackmailed these users for money or influence. It's interesting to try to guess how these factions, each occupying some point on the political/idealogical grid, are going to look like in 10 years. My guess would be that we begin to see more competition between them as well as an increase in internal organizational structure.

ArtDev 11y ago

I may not like the idea of the site, but it wasn't until I started seeings ads for it, that I started hoping for its downfall. My wish was granted!

ArtDev 11y ago
Here is a banner ad I am referring to: http://thehairpin.com/wp-content/uploads/sites/3/2011/04/1-74-percent-affair.jpg http://thehairpin.com/wp-content/uploads/sites/3/2011/04/1-7...
- rue 11y ago
  Me, I have an adblocker and let other people do what they want to do.

evandrix 11y ago

so where's the leak @? .torrent / pastebin ?

jjuhl 11y ago

I don't get why people get so worked up over this. Yes, people have afairs; so what? It's fun and everyone likes to have a bit of harmless sex with new people once in a while. No big deal.

emmapersky 11y ago

It seems that no one is making the distinction between actually having an affair and simply the fantasy of it that most of these members probably engage in. I would guess that of those 40m members only a small handful have ever engaged in an affair through the site.

fapjacks 11y ago

Cross-referencing the dump from this hack with the OPM dump containing a list of everyone with TS/SCI clearance... Now that is a very handy bit of information.

killface 11y ago

Assholes attacking other assholes online? Meh, I'm not going to lose any sleep over it. Some of them will get what they deserve (personal opinion, of course), on both sides.

flippinburgers 11y ago

Cheating is not cool, but acting like all of the users of that site "deserve it" is such a horrendous broad stroke. It just reeks of White Knight BS. Every last person on earth struggles with balancing their own inner desires against the expectations of the society around them. Some are better at this than others. I'm glad some of you are such perfect little angels that you feel that wrecking other peoples live is ok. I've been cheated on before. It was fucking god awful but I wouldn't expect that the other person's life be destroyed as a result. Relationships are WAY more complex than some holier-than-thou promise that people make to one another.