Hacker News Reader

Pretty sure that is not Pinterest:

* The admin looks way too trivial for a site of that magnitude

* Pinterest is built with Django which comes with a secure auth framework included that stores passwords hashed and salted

* Why would Pinterest refer to their own users as "Pinterest users"?

Looks more like a Pinterest spam bot to me.

View on HN

What about "My friend tells me that I should also mention that I was able to log in with the emails/passwords leaked."?

Well, if it's a spam bot that creates Pinterest user accounts then one would obviously be able to log in to those accounts.

Didn't think about that, you're right.

I think it's used to manage accounts and could be used for spam. The giveaway is the form asking for csrf token and session id; both required for Django to authenticate and accept a POST request.

Reply on news.ycombinator.com