@e-sushi out of curiosity, what was the hole?

@e-sushi Sounds like they may have deleted the account in 2013, but they got compromised in the same year, which means that you'd still be in the list of compromised customers and therefore they'd be required to notify you.

Bear in mind that deleting your account doesn't mean forgetting you exist.

arstechnica.com/information-technology/2017/10/…

@tylerl like the classic scam at AFF, they kept a list with details of everyone who paid to be deleted from their lists. And then came the breach....

But it's been 4 years since, so they might have changed a few things since then. I'll probably catch myself revisiting this site for a bit of probing, just to see if and how they’ve “evolved”. ;)

@AJHenderson There were (and probably still are) quite a few holes… back then, several attack vectors tested positive for “SQL injection” fun. Poking around I also noticed several login/authentication issues (as far as I remember one of them was a “constant time“ thingy when the site checked the login data, and there was also an issue related to their use of older hash functions – which were additionally implemented the wrong way.

:)

@tylerl Well, just for the fun of it I tried to login to the “deleted” account using the old password… and I succeeded without any further issues or messages. On their side (and in contrast to their statements back then) the account has never been deactivated or anything.

@M'vy Hi there! Long time, no read… how's life treating you?

Fine fine

I'm usually looking at what's happening here, not talking much though

@M'vy ;)

yeah, just living my life and trying to score some internet points ahah :)

@M'vy arn't we all? ;p

I guess we are

I'm on the look out for a new question :)

@HamZa holy crap, how did it take so long to figure out that vulnerability

or atleast for someone to come forward with it. That's crazy trivial

(at least for the key reset, getting information extracted from the repeating nonce is thankfully a bit more non-trivial, but how did the base issue not get noticed...)

Not sure this is a valid point, but I've heard the word 'paywall' being mentioned today. If that's true, maybe because the only publicly available information is the code of the OS using it?

questions like this one remind me how much specialized knowledge there really is in cryptography

it feels odd for some reason remembering that most people don't know this