Hacker News Reader

Comment by lifeisstillgood | Hacker News Reader

So, just to get an idea, i can buy 1million profiles including pictures for 130 Euros, which I should be able to match against stolen credit card lists (do those come with addresses?) and even old stolen passwords.

I mean, yikes.

View on HN

It's a gold mine for social engineering. Age, location, sexual orientation, relationship status, employment status, interests, aspirations, lots of information based on their Instagram feed about things like travel destinations, friends, parents, pets etc. I'm sure the conversations themselves include a lot of personal information that one wouldn't want floating around the web.

How would one go about monetizing this data?

Make a publicly indexed dating site for people into bestiality and just upload all of these profiles to it. 'Restore' all of the accounts using their emails and password hashes. Like Ashley Madison, charge people money to delete their profiles. Accept only bitcoin.

Thank you for granting me this exercise in creativity... now please don't do this.

Some people have - searchable databases for collections agencies/the police/private eyes/anyone looking for someone else.

I don't think the conversations are for sale.

Nope, probably free for the taking through an obscure, unsecured API endpoint/route.

Any case studies?

I once found a vulnerable API endpoint for a staffing company and ended up exporting their whole client database.

what we strongly believe, USDate web-scraped plenty of fish... already for a very long time. if you go on that site, you will see how easy it is.

Reply on news.ycombinator.com