Hacker News Reader

Comment by duxup | Hacker News Reader

>At its core, the app and anonymous social network allows users to sign up using their corporate email address, which is said to be linked only to Blind’s member ID.

People just trusted it?

I get that to seem legitimate the users have to be confirmed in some way, but as a user... now way am I exposing myself that way.

View on HN

The emails were "sitting plaintext in an exposed database."

Major things wrong: unencrypted email addresses + private messages, leaving the database without a password, database wasn't fixed until a week after knowing of the error.

I find it concerning that this kind of news seems normal now.

The scale of poor security by default these days is pretty horrifying.

I would go further and say using it is gross incompetence along the lines of a broker taking stock investment advice from spam email. Literally the only reason why someone would send out random stock advice like that is doing a pump and dump scheme. Similarly if they aren't going to use your email then they have no reason to ask for it and any 'anonymous' app that asks for identifying information isn't.

I get the sentiment you are sharing and I am not advocating execution of Blind anyway, but it you want to make anonymous "rooms" like say peole from Google belong to one room and Facebook to another. How'd you make that without first establishing that someone is from Google.

I understand taking their work email is asking for more info than desired. Probably they can use something zero-knowledge (I am not well aware of the concept) where someone proves their employer's identity without their own.

Reply on news.ycombinator.com