Hacker News Reader

Comment by turbohedgehog | Hacker News Reader

Preliminary report out from Let's Encrypt: https://community.letsencrypt.org/t/email-address-disclosure...

as far as I know, all emails starting with 0-9, A-Z and at least part of 'a' were exposed. I did not get one starting with 'g', so it's somewhere between 'a' and 'g' that it got stopped.

Edit: "7,618 out of approximately 383,000 emails" were sent out

View on HN

Was just able to confirm, it's up to and including your email address. Mine starts with m so I see 3,761 email addresses. But for me, none lexicographically after my email address are exposed.

Edit: Just want to add that I've made a similar mistake before (with a smaller user base). So I understand how easily these bugs occur. Given all their progress in the last few years, I still believe that the privacy and security of such a large portion of the Web could not be in better hands. Props to the LE team for a quick, responsible response.

You mean M, not m. (it's in ASCII order). Also giving out the number of addresses you see will allow someone after yours to connect your username with your email address if you weren't aware.

Yes, sorry, "M". And if this comment[1] is true, then that number won't reveal much. Their mailer is probably distributed across several nodes.

[1] https://news.ycombinator.com/item?id=11881953

Multiple different images and a pastebin I saw posted on twitter showed the same starting set of emails.

I also didn't get one, and mine starts with "an." So a good chance they caught it pretty early.

Or, perhaps it's just been too long since I've used it actively? Sounds like parent did in fact have their email at least in the body somewhere, even if they didn't get one sent to them. Perhaps I'm the same.

Mine starts with 'ab' and is ~7200 on the list

Reply on news.ycombinator.com