Hacker News Reader

Comment by cheald | Hacker News Reader

I already did this. I'm tempted to set up a utility page where you enter your email and the utility just tells you if it was in the DB, but I don't know how legal that would be. Checking the data for personal defensive purposes is arguably defensible - setting up a tool based on that data (even benign) is likely less so.

View on HN

For people who can't remember if they ever signed up:

Go to gawker.com and use the 'forgot my password' utility. It's under login > forgot my password. Enter your email address in the field provided. It will tell you straight away "That email address is not in our records. Please try again."

I can't think of any reason this would be incorrect based on the recent events. Of course, this doesn't tell you whether your password is vulnerable, just whether you have an account.

Please do. I don't want to download the torrent and I don't know if I have ever commented on Gawker but there is a slim chance I might have.

Apparently somebody thinks they're a "white knight" I just got an email from "The Team at Hint" (teamhint at hint dot io). The text is:

Hi there,

Hint wanted to let you know that your email address and password that you used to signup for Gawker (or one of its sites) were hacked. Forbes' coverage is here

In situations like this, time is of the essence, which is why we were surprised & shocked to find that Gawker Media hadn't taken the initiative to notify you of this privacy breach immediately. We HIGHLY recommend you change all of your online passwords as a precaution.

-The Team at Hint

(This is a one time email)

I'm not sure how ethical this is.

I can't see how it's unethical, unless even looking at the data is unethical, and you'll have to convince me of that. I'd be more concerned about the ramifications than the ethics. The least bad thing that could happen here is winding up on some big ISP's blacklist because enough of their users marked this unsolicited mail as spam. Once that happens, good luck communicating with your customers.

I'm sure you can imagine the worst that could happen. Courtrooms are not happy fun places.

Perhaps you're right (I did say "I'm not sure"). But it did seem a bit ... off ... to me.

I found this same email in my gmail spam today.

The message is lined with tracking URLs. http://identityvector.com/~phil/2010/12/how-not-to-capitaliz...

What about emailing everyone in the DB?

"Unsolicited scary email from some guy that got my email from a hacker" sounds like it would only be slightly less legally dangerous than just straight up forcing hashes and posting them.

Ha. True

I don't know about that.

Personally if someone would mail me warning me some site that I am a member of has been compromised I would thank the guy.

Gawker probably will not see it that way, but since these email addresses are going to be spammed to death anyway I would think that's a minor issue.

You are likely far more savvy than the average recipient of an email on that list, too. :)

Reply on news.ycombinator.com