Hacker News Reader

Comment by jaas | Hacker News Reader

Head of Let's Encrypt here. Our automated mail system had a bug that accidentally exposed about 1.9% of subscriber email addresses to the same 1.9% of recipients.

Our sincerest apologies for this mistake. We will be doing a thorough postmortem to determine exactly how this happened and how we can prevent something like this from happening again.

There is a preliminary report on the issue here:

https://community.letsencrypt.org/t/email-address-disclosure...

View on HN

We've changed the URL to that from https://twitter.com/aaronraimist/status/741456355693760513 (and the title from "Let's Encrypt is sending out a list of all their users' email addresses").

What do you need email for, anyway? Not giving you one makes it pretty easy not to leak it.

They send reminder emails when certificates are due to expire.

Reminders/alerts of certificate expiration, for a start.

FWIW providing an email address is optional.

How big do you estimate your fine would have been if you were operating in the EU?

For sharing a few email addresses? $0 I'd imagine. It's not like its anything important like credentials for shopping/banking or other details which could be used in identify theft. Worst case scenario; google's spam filters have to work a little harder. You'd not even notice. Yes, some people have chosen to run their own mail servers for some reason and those people might conceivably get a bit more spam for a while.

Email addresses are absolutely personal data, and in the EU companies need to protect that data from being leaked.

(There would probably not be a fine; the company would be investigated and warned by the various regulators).

> Yes, some people have chosen to run their own mail servers for some reason and those people might conceivably get a bit more spam for a while.

Once your email is out there, there's no going back.

Email addresses are personally identifiable information, and revealing a relationship between a business and a person is potentially very dangerous.

For example: http://www.bbc.co.uk/news/technology-36247186

You guys should all switch to disposable email addresses. It solves so many problems. If your address is leaked like that, no big deal, you just delete that alias. If a password is leaked along, again having website specific emails will make it very difficult to correlate your credentials with another website. If you start receiving spam on that address you just delete it. And so it ceases to be personally identifiable information.

Should I use a disposable name and a disposable address when I buy physical goods from an online retailer?

I actually start to think you should, without joking. At least the name.

If you look at the past 5 years, there is almost not a single major website that hasn't been hacked and hasn't leaked personal data. Not only do I see no sign of improvement, but it is rather accelerating. Leaking information on 30m+ people is now becoming common and barely makes the news outside of a few specialized websites like HN.

If you have a better alternative than feeding garbage data to websites who want to collect data they won't need (why would an online retailer give a shit that they are shipping a product to someone called Mr X rather than Mr Y?), I want to hear it.

Why not? What's the cost? What's the benefit? I create new accounts for all sites I use, including hacker news, every year or so.

In case you're referring to the General Data Protection Regulation, it does not apply until May 2018. The penalty that would be applied would probably be this one, given that the number of prior offenses, the gravity and duration of the offense, the number of affected users and the damage caused, etc. need to be taken into account:

> Each supervisory authority shall have all of the following corrective powers:

> [...]

> (b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(IANAL)

There are already similar laws in the UK and other countries.

See this recent example, where a sexual health centre accidentally leaked a list of 800 people who had attended HIV clinics.

They ended up with a £180,000 fine: http://www.bbc.co.uk/news/technology-36247186

Good point and very similar case (though in an entirely different category of "damage caused", plus there seemed to be a prior offense).

Most people would consider their possibly/definitely having HIV to be a more personal piece of information than their email address.

If I'd been affected by this Let's Encrypt email thing I frankly wouldn't care, other than to question why it happened. (Just speaking for myself, I'm sure some people would care.) But if I was data in a leak revealing a personal serious medical issue, I absolutely would care.

Data protection is already regulated by the EU (only by means of a Directive rather than a Regulation) so the same principles apply across the EU/EEA, if not the exact rules.

Good to notice that the new EU data protection regulation already has influence on the discourse even though it shall apply from May 25, 2018. And more importantly, even though Letsencrypt is a US based organization it applies directly or indirectly.

For those interested, I can highly recommend the documentary Democracy: Im Rausch der Daten (2015) [0]. For 9 month the documentary follows MEP rapporteur Jan Philipp Albrecht and his policy advisor Ralf Bendrath [1] (hacked a C64 in his youth, frequent attendee at C3) and gave a rare inside in the negotiation & process in Brussels. They even recorded the final negotiations in the backrooms and for those knowledgeable on the topic it is very interesting to see how some of the deals where made. After the screening at IDFA the director said he wasn't onset to make a documentary on the EU data protection reform and that Jan Phillip's rapporteur topic was chosen as an example EU process. Regretfully this documentary isn't exemplary for the EU process because most of the time the lobbyists of the large corporations have a far larger influence. The documentary clearly shows that the final text has been the result of the persistence & integrity of the the 3 main characters Albrecht, Bendrath and Redding. And as we're experience now, this has great influence on data protection for more than only Europe.

[0] http://www.democracy-film.de http://www.imdb.com/title/tt5053042/

[1] http://www.bfna.org/person/ralpf-bendrath

Reply on news.ycombinator.com