Hacker News Reader

They guess it could be a user database leak, making it possible to use https with password auth for pushing. But the attacker didn't know the usernames.

Can't that also suggest that the user database is fine (otherwise they would have guessed correct usernames in the first place), but when a user was found they could find their password in some other leak?

View on HN

As we don't really know, we went with the worst-case assumption. If it's wrong, then at least it was a nice excuse to update some old infrastructure :)

I came to say the same, though I suspect they may have gotten the passwords by watching them being typed. These people go to conferences or whatever and could have leaked the password, but the username probably wouldn’t need to be typed.

At least to me, this seems like the most obvious vector for a leaked password, but not username.

Reply on news.ycombinator.com