Hacker News Reader

Comment by tredre3 | Hacker News Reader

> To check on the validity of the information, Fowler emailed many of the people listed in the file and told them that he was researching a data breach. Several of the individuals confirmed that the records contained valid account passwords and other data.

Do security researchers really contact people willy-nilly and ask them to confirm their passwords? Then they lecture us about the dangers of social engineering?

View on HN

If they already have your password (i.e. it has been compromised) there is no social engineering taking place.

In fact, they're doing the honorable thing and not simply trying the credentials to see if they work.

I think what they're saying is that someone could pretend to be a researcher and ask for passwords to confirm that they match what was found in some fictional breached data.

If I'm reading it right the part about them confirming that the records contained the password implies that they were given the relevant record and then they confirmed it was accurate, not that they were just asked "hey what is your password"

For clarity this is what was said about emailing and confirming authentication of data: "To confirm the authenticity of the data, I messaged multiple email addresses listed in the database and explained that I was investigating a data exposure that may have involved their information. I was able to validate several records as these individuals confirmed that the records contained their accurate and valid passwords."

Reply on news.ycombinator.com