Hacker News Reader

Comment by greendestiny | Hacker News Reader

I would think a lot of people would pay to keep such information secret though. Maybe not enormous sums individually but given data that you can personally verify this would be a fairly effective threat.

I'm imagining the typical popup - 'Warning your browsing information is compromised - pay us to remove the offending data!'. Add to that page a list of actual viewing history and I think conversion ratios would increase.

View on HN

I think this would tremendously backfire. It wouldn't be too difficult to figure out which companies have leaked customer data, which is now being used for extortion, and they'd likely lose more money than they could gain from the ad clicks.

Reputable porn sites tend to be more secure than your average company website specifically because they know that privacy is important to their viewers. Being known for leaking your viewer data would be suicide.

The sites themselves wouldn't likely leak these data, rather it could be compromised.

From the article: "All that's needed are two nominal data breaches and an enterprising teenager that wants to create havoc."

A very substantial proportion of porn viewers don't restrict their browsing to "reputable sites", and a very insubstantial portion of porn viewers have the will and inclination to retrace their browsing history trying to work out which ad network or tracker beacon is responsible for the disclosure in order to report them to site owners which may or may not be part of the scam. It's not as if nobody is selling clicks to websites making amateurish attempts to persuade you to pay up or face investigation.

    > but given data that you can personally verify

But of course, you can't.

If I have your browsing history, and it's clean, I can threaten to throw in some random unpleasant links, and still threaten to release it as "credible looking". If I have your browsing history, and it's dirty, and I do release it, you can just claim I have tainted it as part of a blackmail attempt.

Presumably they can't verify it, but I feel like real data would be much more likely to convert to 'sale'. Besides if that's the particular strategy the site takes then it may well develop a reputation for reliability in some sort of way.

My point is: you will always have the plausible deniability that the blackmailer has simply invented dirty data, and mixed it with real clean data

I understand and I agree. My point is just that sites make money with fake claims of viruses on your computer - I think real browsing history would scare the money out of enough unsophisticated people to make it profitable.

Reply on news.ycombinator.com