Hacker News Reader

Comment by rahidz | Hacker News Reader

"The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password."

Dear lord. Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'ed/bookmarked? Like a miniature version of the Ashley Madison hack.

View on HN

It's worth noting that often, the email can be correlated with other breaches to get your real name. People can do that relatively easily on osint websites. I wasn't terribly pleased when I found my teenage furaffinity account show up in an identity theft monitoring app. Other people have turned up in breaches of far more objectionable websites.

If your email provider offers email aliases, you should really get familiar with how to use them, and use a unique email alias per website.

At this point it’s all public. Everything you do on the internet is or will be public.

I was also in the furaffinity leak lol. Though ultimately everyone is in so many leaks it won’t even matter. Unless you have committed some kind of crime, having possibly embarrassing personal details leaked is the reality for everyone right now.

Also, character assassinations. Good luck telling fact from fiction!

I think we are approaching a future where no one will care. An example would be the Canadian prime minister who had photos of him doing black face as a teenager emerge. And nothing happened because everyone has embarrassing teenage past actions.

A good example would be the pedo felon sitting in the Whitehouse.

>An example would be the Canadian prime minister who had photos of him doing black face as a teenager emerge.

He was a teacher at the time, at West Point Grey Academy, not a teenager. [1]

I'm not saying people can't grow and make mistakes throughout their life, and become better people, but it was definitely not a teenage mistake.

[1]: https://www.cbc.ca/news/politics/canada-votes-2019-trudeau-b...

My memory of it is fuzzy but I feel like that exemplifies the point more. No one really faces any consequences for this stuff leaking unless it’s truly bad. After all these hacks everyone is going to have embarrassing details leaked but it probably won’t matter.

Best practice to use your non-primary email address for these kinds of site. Data breach is a matter of when, not if, it happens.

Tbh it's probably a good idea to have a bunch of different e-mail accounts, at least for all of the professional, personal and other personal things.

There's horror stories of automated systems suspending people's Google accounts and suddenly they can't access their photos and other important data.

Like if you use a password manager and all of the passwords are random, might as well go a step further and at least have separate e-mail accounts for groups of activities.

Did anyone sign up to that with their real name or email?

I'm certain many people signed up using established internet identities which can then be linked to real world identities through social engineering techniques.

Unless you had a unique email just for that service, you could just cross link it with another leak that contains your name.

Sure it’s possible to have perfect op sec but almost no one does in reality.

I did. I couldn't care less if people know I write fanfiction. I talk about it IRL with people, completely without shame. firstnamelastname@gmail.com

I am certain that many people will have signed up with an email address that contains their real name. If this leaks I’ve gotta imagine that someone with a particularly dark/evil sense of honour makes a tool where you enter an email address and are shown an AO3 presence.

If you put a phone number into Grindr's "forgot password" feature it tells you whether there's an account with that phone number or not.

Reply on news.ycombinator.com