53
submitted 1 day ago* (last edited 1 day ago) by helloyanis@furries.club to c/privacy@lemmy.ml

I just found a security breach that can leak thousands of emails on a website!!

Today, I snooped around on a website I won't mention the name of for privacy reasons, and they assign your account an user ID when you register.

Well, with a very simple trick in the console I managed to get everyone else's email and account info (for example checking if they have a paid plan or not) by just lowering the user id, with no rate-limit on the endpoint!

So a bad actor could send targetted phishing emails to people by telling them there is a problem with their payment!

It's funny because on their homepage, they state they use "Military grade encryption" (whatever that means!), and their privacy policy says "We encrypt the transmission of that information" (does that just mean they do it over https?)

So, moral of the story, don't trust companies with your personal info!

I contacted the site, we'll see if they fix it.

@privacy@lemmy.ml @privacy@lemmy.world @soatok

#cybersecurity #privacy #web #hacking

you are viewing a single comment's thread
view the rest of the comments
[-] CodenameDarlen@lemmy.world -3 points 1 day ago* (last edited 1 day ago)

Seeing your profile you manifest an exclusive behavior like using hashtags and tagging communities very often on posts and comments, it seems something only an AI would care about. Too much correctness.

[-] helloyanis@furries.club 13 points 1 day ago

@CodenameDarlen It's because I post on mastodon : My instance is furries.club (check my username) and that's a Mastodon instance that works with hashtags to find posts. Instead of writing the same post multiple times, I use instead the ๐“ถ๐“ช๐“ฐ๐“ฒ๐“ฌ ๐“ธ๐“ฏ ๐“ฏ๐“ฎ๐“ญ๐“ฎ๐“ป๐“ช๐“ฝ๐“ฒ๐“ธ๐“ท to write the post only once with hashtags and by tagging the Lemmy community so that it also gets posted there, and people who comment in one platform will also have their comment show up on the other platform.

[-] CodenameDarlen@lemmy.world 2 points 1 day ago

Peak use of technology

[-] floquant@lemmy.dbzer0.com 3 points 1 day ago

Whenever you see a user starting their reply with a tag for the user they're replying to, you're interacting with a threadiverse user, usually mastodon or pixelfed

[-] helloyanis@furries.club 4 points 1 day ago

Not in all cases actually, as is shown by this reply! Mastodon just defaults to including the @ of the person you are replying to, so they get a notification, but it works without!

this post was submitted on 06 Mar 2026
53 points (92.1% liked)

Privacy

46763 readers
700 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 6 years ago
MODERATORS