_jvqm

7 ms·

1.
by _jvqm 4y ago
Yes sir, not contesting any of that, Troy Hunt may receive an anonymous email soon.
2.
by _jvqm 4y ago
Thanks for the laugh. Okay, guilty by association.
3.
by _jvqm 4y ago
First, thank you very much for your comment, secondly, the anonymous person has forgotten to specifically highlight a certain detail - The entity affected by this vulnerability is NOT a trustworthy company, it is not even a registered compa
4.
by _jvqm 4y ago
Finding such a thing might be somewhat special, but (referring to your comment) having theoretical access to money is definitely not a special thing.
5.
by _jvqm 4y ago
That seems like an unfit comparison. If anything, they have found your key on the sidewalk, sat inside the car for 10 seconds, and then left again.
6.
by _jvqm 4y ago
I don't have access to anything. Besides, I'm surprised that they would be the only person you know that has access to money.
7.
by _jvqm 4y ago
These statements stand unchanged. The usage of "pretty extreme" could be regarding the "quality" of data, not quantity. Compared to the usual data leaks on HIBP it seems like an occurrence that happens frequently and the
8.
by _jvqm 4y ago
They are, or I wouldn’t be posting here, but I sincerely thank you for your concern and advice.
9.
by _jvqm 4y ago
If there is something they will not do until they have spoken to an attorney it is exactly this..
10.
by _jvqm 4y ago
While the anonymous person understands some of the responses, and will make super sure to do absolutely nil until they have spoken to an attorney (and obviously not access anything on purpose now), they too are a little bit surprised to see
11.
by _jvqm 4y ago
No blogging.
12.
by _jvqm 4y ago
I will tell an anonymous person to do this, but I’m not sure if Troy Hunt cares about a random one-of-thousands service and a few thousand affected users.
13.
by _jvqm 4y ago
.. deliberately given it to burglars? Absolutely nil has happened besides finding this.
14.
by _jvqm 4y ago
First of all, I'm only telling a story of another unnamed person - besides, what exactly are you so worried about?
15.
by _jvqm 4y ago
That is not a very special occurrence. I’d argue you can find almost anyone with access to a million dollars online. Just go to Twitter or so.
16.
by _jvqm 4y ago
Fair enough. I dont think they are planning to use any information.
17.
by _jvqm 4y ago
It is not a honeypot, it’s a service that uses these API keys. I am aware of the withdrawal logics.
18.
by _jvqm 4y ago
Fair enough
19.
by _jvqm 4y ago
They have been considering this too, but realistically this is a little known service, there are thousands of it like it, and the affected user count is only in the thousands. I don’t know if any of these people would care in the first plac
20.
by _jvqm 4y ago
I have not committed any kind of crime. I'm just telling the story of another person.
21.
by _jvqm 4y ago
Trust me, they are.
22.
by _jvqm 4y ago
Lol, trust me, they will not start a bug bounty program.
23.
by _jvqm 4y ago
They are not based in the United States, but I think you are right regardless and they will call an attorney tomorrow.
24.
by _jvqm 4y ago
Of course they want to white hat this. Their cryptocurrency is not stored on this site.
25.
by _jvqm 4y ago
They would rather not live in the assumption that they are responsible by proxy/neglect.
26.
by _jvqm 4y ago
Step 3 is definitely and understandably so not a very legal thing to do, however I'm not sure about simply sending off emails? The person in question did not do anything illegal to gain access to this database in the first place, it i
27.
Ask HN: I found a pretty extreme data leak and I'm not sure what to do
107 points by _jvqm 4y ago|116 comments