The YouPorn Chat leak revealed a lot more than email addresses and passwords | Hacker News Reader

The YouPorn Chat leak revealed a lot more than email addresses and passwords

blog.jgc.org

42 pointsjgrahamc16 comments

I'd like to point out that the service that was hacked has nothing to do with Youporn itself, it was run by a third party.

So please stop calling it the Youporn leak, nothing has leaked out of Youporn itself, just a careless third party.

"YouPorn chat, a service operated and hosted by a third party, failed to take the appropriate precautions in securing its user data" - Kate Miller Manwin Spokeswoman.

Thanks. I have updated the blog post and the title.

And I guess this is why established brands are so uptight about other companies or services using their names. I had no idea this was a 3rd party until seeing this article.

It doesn't matter who runs it, they're still responsible.

If I hire a company to fix something, and they sub-contract it, the original company is still responsible. Accepting anything else brings only disadvantages.

http://news.ycombinator.com/item?id=3623110

I also never make mistakes. All mistakes are the work of a third party former element of myself that I no longer affiliate with, or plan to disaffiliate from at some point in the future. It's not me at all.

YouPorn chat was located at chat.youporn.com. As a reminder, YouPorn's website is www.youporn.com. Until recently, there was a prominent "Chat" link from the YouPorn website to YouPorn Chat too (which AFAIK didn't disclose that it was run by a different company).

I think people have a legitimate reason to be confused by the line between YouPorn and YouPorn Chat. Until this episode of total incompetence surfaced, I'd say the two firms were quite happy for this line to be as blurry as possible.

YouPorn was clearly making money from this arrangement - otherwise, why allow a different company to piggyback off their high profile brand. It seems only fair that YouPorn's brand now suffer.

Are you saying that the Y company is not responsible for what they allow to install on their subdomain?

It is a youporn link as it was their service under their domain name and brand. Doesn't matter who ran that. Just few days (week?) ago there was similar leak from some India's Microsoft page. If I remember correctly everyone agreed that Microsoft is the one to blame. I agree that clarification is necessary but acting like youporn had nothing to do with that is not.

Exactly. Apple is responsible for it's supply line. Youporn is responsible for whatever third parties they utilize to bring a service to market.

Didn't the lead software engineer for YouPorn just comment recently on the Redis thread?

Maybe he could chime in here and shed some light.

He already did : http://news.ycombinator.com/item?id=3623079

So "a lot more" is basically just the faked DOB and faked phone number field? Why does this justify a blog post, especially when those fields were mentioned in the original sophos post?

I wasn't aware that blog posts had to be justified.

Blog posts no, Hacker News entries yes.

What I really meant was, why does this justify the alarmist headline? That is, the security leak is bad enough. Everyone savvy enough to use a throwaway mail account likely used a throwaway phone/DOB. Those who didn't are already pretty well screwed...losing their phone number is not "a lot more" of a problem for them

The phone numbers were not mentioned in the Sophos post. You are correct that the DOB was (I had missed that). It seemed to me that the phone number being present was pretty significant.

Reply on news.ycombinator.com