Hacker News Reader

Comment by hasty_pudding | Hacker News Reader

are emails private info?

It may depend on definitions. Where I work, we classify users' emails as "personal" information, and we would consider it a breach if all the emails were leaked.

I can see it being a low tier breach.

In many cases: yes. That you need to tell others your email address to be able to use it doesn't mean it can't be used to identify you, especially if your email address is hasty.pudding@gmail.com everybody will know exactly what your proper name is.

yeah but isnt a person's name as public as their email?

I can literally go to the tax assessor's website and search an address and find out exactly who owns that property.

Not in every country.

They're a part of the composite "keys" tied to managing your personal identity. If you use one email for everything, having that email exposed means that a portion of that key has been compromised, and you may be targeted by attackers that previously did not know of your existence.

If you use a unique email for everything, attackers need to determine email+password+whatever, instead of just password+whatever, where "whatever" is security questions or compromising 2FA.

These emails can be used for targeted advertising: this email works in tech or startups, let’s show ads to them!

Given that it most certainly doesn't work with current big-name advertising companies, I'm skeptical it's gonna work with some random data leak.

But if a data leak finally gives me meaningful ads - that'd be nice.

What do you mean? Big tech advertising unfortunately works too well for me. A friend heavily uses the look alike feature on fb to target similar people that purchased his product. Fever ticketing also uses this too.

If you’re having ad quality issues, it could be that they don’t have good advertisers matching your profile.

if you work in tech and you don’t know a way to block all online ads what the hell are you doing

Well as the page states, these were scraped from a public endpoint. So not really

What's the endpoint? Why did it provide personal information? Why wasn't it throttled?

Many things don't matter at a small scale, but they do at 15M-scale.

Trello users are about to get bombarded by phishing attempts and spam.

> Trello users are about to get bombarded by phishing attempts and spam.

All of the emails present in this "leak" were taken from other dumps. That's how it's made, they took a list of known emails and tried to link them to a trello account.[1]

> What's the endpoint?

I think https://developer.atlassian.com/cloud/trello/rest/api-group-.... The endpoint allows you to get all public info (bio and username) from a trello account by its email.[2]

> Why did it provide personal information?

So users can invite other users to their boards via their email address.

> Why wasn't it throttled?

It should've been.

[1]: https://haveibeenpwned.com/PwnedWebsites#Trello

[2]: https://www.bleepingcomputer.com/news/security/trello-api-ab...

Checkmate hackers. I already am bombarded by phishing attempts and spam.

Reply on news.ycombinator.com