Hacker News Reader

Comment by sinatra | Hacker News Reader

I actually thought about something slightly related -- With the AM drama, won't an individual have a reason to signup to all shady websites with their worst enemey's email address and then wait for one of those sites to get similarly hacked? Would some people have created AM profiles of others just as a joke, and now those people might be in trouble?

I once found a dating profile of mine that was created by an overzealous relative. Thankfully this was few years before I met my spouse.

View on HN

Couchsurfing.com does this a little differently - they mail you a post card and you enter your 2-factor code from the postcard onto the website, verifying that's your real address.

I'd imagine this method won't work for sites like AM...

It's been done. And by a police chief too: http://www.news8000.com/news/embattled-town-of-campbell-poli...

Update: Here's a better article focusing more on what the chief signing up someone he didn't like rather than focusing on the chief retiring for medical reasons: http://www.nydailynews.com/news/crime/police-chief-pleads-no...

> won't an individual have a reason to signup to all shady websites with their worst enemey's email address

Well usually sites verify that the person signing up on a site is the owner of that address, in a large part for this very reason.

I've heard that AM didn't verify. And I'd say many shady websites won't.

That seems to be the case. But then one has to wonder why they bothered collecting the addresses in the first place. If I were running a service that most people would prefer others not know they use, and I were not verifying addresses, I would expect that very few of the addresses I'm given would be of any value. Since I haven't verified them, I can't really use them myself, and I'm not likely to find much interest if I try to sell them. So why even ask?

That's a cheap form of plausible deniability, then.

HN doesn't, either.

In Django, as an example of one web framework, the email address would still be in the users table. There'd be a flag somewhere else in the database to indicate whether it had been confirmed or not. Only a sign up system that has separate storage for unconfirmed registrants, or that purges unconfirmed accounts after a period of time, would keep your email from showing up in the dump if a buddy signed you up as a prank.

Reply on news.ycombinator.com