@ThoriumBR .... "old enough" >_>

I always wonder how old SE users are… one can estimate, but it’s impossible to know without them explicitly saying

One of the sites has a 80+ year old mod :D

@JourneymanGeek !! Let me guess… alcohol.stackexchange.com :-)

japanese if memory serves

Ohhh

Of course!

Imagine an 80 yr old mod on SO

!!

Age is just a number

Till you die

or your back gives out

Or arthritis stops you from typing…

Or you commit a crime

Or you go into a vegetative state

Yeah, only a number D:

@JourneymanGeek what ever happened to that SU user who claimed to be a 10 year old boy from Egypt?

We don't discuss those. We escalate it to the community team, then let them deal with it

mmh. I remember you saying you passed it on to them.

As a mod, is it actually possible for you to delete any user account? E.g. a high-rep user or another mod? Or is this “secret” information…

I don't remember off the top of my head of the exact numbers. There's a certain cap for destruction which is distinct from deletion (which preserves posts and needs some additional info and justification, and I hardly use that)

I can't destroy a high rep user, mod or community (people tried)

I don't need to anyway

So, I've confirmed it all. The Unsubscribe link in the welcome email (without email verification) includes the username and a hashed string that automatically logs someone into the account. Sessions do not expire after 5 days, and the hashed string has not expired yet. So, that string is the de facto password (if it isn't just the password in reality). I've sent 3 messages and a warning not to charge their poor customer else I will name and shame. No response.

all from a "cybersecurity" company established in 2018 to protect people from ID theft.

lol

I looked up their Trustpilot reviews and every single positive one for the past few months looks ai-generated

I ran the SHA1-looking string through crack station and it didn't turn anything up, so it's not a known string or a common password

if it IS the user's password, let's hope it is salted

@schroeder and the password (de facto or not) is sent via email, to whatever email provided!!!

It’s beyond appalling

It’s just outright unjustifiable

I start naming and shaming on the 21st which is when I will see that they have charged the customer. I will know because, of course, I can see the payment details and receipts.

Haha. it appears hard not to know everything about the user, seeing as the company’s handed you their account on a gold platter

anyone know of a blog/site where one can post a write up like this?

I thought of something funny: maybe the majority of that company’s customers are customers because they are victims of ID theft of that company!

Oh, I don’t know… you could create a blog site yourself?

in general, I've found a lot of ppl saying the company is scammy

I don't want to create a site just for this one thing

They are the scam

The rest of my normal content is not related to this sort of topic

I see.

Haven’t seen you in the DMZ for a while… good to have you back.

A typical case of people being drawn together over an enemy (the enemy being that company.)

@schroeder I suppose you could write a medium post, then again, kinda tacky

I emailed their Privacy email to see if it would be different. But no, it all goes to their Zendesk, which they have never answered....

I’ve once done the same thing a few months ago. I still haven’t heard back.

I wonder if that company has a ciso, of if they just hire standard IT folks for their security

Or maybe they don’t hire anyone for their security

small company. I get the impression that everyone might be working multiple jobs

I kinda feel had for them. But i feel worse for their customers

@schroeder The Register, or Krebs on Security, or /r/netsec, or the DMZ

or you can have multiple people open the same channel, and have a job running on crontab, and when it fails it sends a notification, and everyone on the channel gets it. it's quicker than email, and you don't need to install anything anywhere, it only takes curl on the server and a browser

@JourneymanGeek it's like uptime: the higher it gets, the more likely to something to break and take down the system: unpatched bugs, inconsistent configuration, hardware failures...

@ThoriumBR I see. That does sound pretty useful, actually.