Hacker News Reader

Has anyone considered that the LinkedIn hack (6.5+ million accounts, with passwords run through a non-salted SHA-1) could be responsible for much of this?

I remember a lot of people having their Diablo 3 accounts hacked and their items stolen right around that time.

View on HN

This seems possible. People usually use the same email and password for every accounts they create so all the hacker needs to do is to try the username and password on accounts on other sites.

The article specifies that many people targeted used emails unique to their dropbox accounts.

Spam went to "unique email addresses for Dropbox".

So a compromised LinkedIn account wouldn't expose a user's unique Dropbox email address. There would be little to no reason to give LinkedIn a unique Dropbox email.

On the other hand, if you need to share your Dropbox email with other people in order to share private folders, or anything similar, then just compromising THEIR computer could expose your email address.

Reply on news.ycombinator.com