Hacker News Reader

Comment by neya | Hacker News Reader

I don't know about the passwords, but my card was successfully stolen[1] and a malicious transaction was initiated from another country. I know this was because of Adobe for sure because I (co-incidentally) used a brand new, fresh, unique e-mail address just for Adobe, and that email was released recently in the dump that the hackers provided.

Luckily the malicious transaction was declined by my bank and they blocked the card for me and they told me that someone had compromised my card details and issued me with a replacement card free of charge.

I only keep posting this in every thread[1][2] about Adobe because I genuinely want other Adobe customers to understand the gravity of the situation and disable their compromised credit card and get it replaced by a new one as soon as possible.

[1]https://news.ycombinator.com/item?id=6668013 [2]https://news.ycombinator.com/item?id=6632385

View on HN

My creditcard and the one of my coworker got blocked too; I only use this one for company expenses, Adobe being one of them. The only overlapping service my coworker and I paid for with a creditcard was: Adobe. We both got a new one in a week from our banks; but this, to me, makes it look like it was definitely compromised because of the Adobe breach.

So you know for sure your email was stolen in the attack, but how do you know the credit card was?

It was only the night before the hack had I bought an Upgrade to the CS6 suite. In all probability, mine would have been listed out in the recent few transactions on Adobe's database, maybe?

There is only one other service I am using this card with - A stock photo site and they haven't announced any security issues, yet. Plus, I always am required to enter my card details on their site each time I buy something, in all likelihood, they aren't probably storing the card on their servers, which leads us to the culprit, Adobe.

Also, I am very security conscious in general. I am no security expert, but I always use Linux/Mac to make transactions, with Firewalls, stuff like that.

Is there an online service to check your email address is in there? I didn't get an email from them (perhaps it got stuck in my spam folder that gets auto-deleted weekly), but my credit card got hacked soon after.

This one: http://adobe.cynic.al/

What is that all about? The site makes a claim of making a search through 150mio records a big deal. Ok, it is not trivial, but any decent DB with proper indexes would have no trouble doing that. Am I missing something?

Also, they want me to enter my e/mail to check... <lost me here already>. Seriously?

It checks if your email is in the dump. What would you want, just a full list of everyone's emails in plaintext for the world to see?

Given they're no longer secret, that would seem safer than typing my e-mail address into an untrusted site to see if it has been compromised.

While you should not take my word for it, I am friends with the owner of that site and it is perfectly safe to put your address into there. The author and I were sharing data.

A form to enter the sha1 of your email address so they can check against a list of addresses they've already sha1ed? And a form that takes the email for people that don't give a shit or don't know wtf a sha is.

Maybe just a .txt of the hashes too, but then no ones coming to your web service I guess.

That makes no sense - they have the plaintext of the email addresses they SHA1, so they can correlate it just fine when you enter it in, too.

But if they don't have your address, ie it wasn't leaked or they're full of shit and never had the list, when you enter the SHA1 you don't give them the address.

Reply on news.ycombinator.com