Hacker News new | past | comments | ask | show | jobs | submit login
[dupe] Thousands of xHamster login credentials surface online (techcrunch.com)
55 points by subpar on Nov 30, 2016 | hide | past | favorite | 48 comments



Original source of the news about the leak it looks like, http://motherboard.vice.com/read/hackers-are-trading-hundred...


Which received some discussion earlier today:

https://news.ycombinator.com/item?id=13063564


“The passwords of all xHamster users are properly encrypted, so it is almost impossible to hack them. Thus, all the passwords are safe and the users data secured."

The passwords are hashed using unsalted MD5.


Eugh.


how I use porn sites:

1. register an email account to some unknown email provider with unintelligible username and email names and don't use it for anything after registration.

2. register to a new google account with another unintelligible username and email names referring to backup email registered in 1 and don't use it in any personal or professional needs.

3. go to porn sites.

4. after some time register a new google account referring to email registered in 2 and never use the old 2 emails in 1 and 2 again.

5. repeat 4 every 6-8 months.


>register an email account to some unknown email provider with unintelligible username

that actually puts you on the radar, because hardly anyone uses "unintelligible" usernames on unknown email providers. what you really want is legit looking emails (first name + last name + number) on popular provider sites. why draw attention to yourself (albeit anonymously) when you can blend into everyone else?


Among millions of email addresses, who would bother to identify and target high-entropy ones, and why?


Honest question: why? This is a lot of trouble to potentially hide the fact that you sometimes watch porn.


I never understood why porn has a +1 button on it. Why would you want anyone to know that you actually use Google+?


Dude, some people actually have their real picture on porn forums.


Some people enjoy very specific genres. Do you really want your family and workplace to know you rather enjoy watching Klingons fellate Ewoks?


Surely it would be the other way around.

I mean, I get the idea behind transgressive pornography, but be real.


...

I need a mind bleach now.


It is exactly this kind of bigotry that forces the KFE scene underground.


doing that whole routine once is probably good enough. Who cares if they grab your porn account? The only thing there will be... porn. Mask your identity and all they have is some rando's porn spam


Why register at all?


How I use porn sites:

1. Go to free site and watch videos without ever even considering registering for anything.


your ISP knows everything anyway. I'm afraid that they will blackmail us in the future since most porn sites don't use https.


With what? The fact that you watch porn? Jeez what a sin.


It's never like that. They'll be very explicit about your porn viewing. "webkike is addicted to asian milf porn. last saturday, he spent 4 hours during the day on 238 videos. at night, he switches to videos of teens being choked. look at this image of a girl in tears, that we cropped from one of the videos on webkike's hard drive. who knows if they're under 18 or not? is this the kind of person you want near your children?"


I'd love to be at the pitch meeting at Time Warner, Comcast, or Verizon, where one of the execs says, "Look, we all know controlling the infrastructure is a suckers game, and the real money is in blackmail."

"Right, brilliant thinking Ted. What about profitability?"

"Well, we'd have to do this to a lot of customers to make it worthwhile, since our annual revenues dwarf what most people could pay. I'd say roughly 30% of our customers should be sufficient for a trial period though. But once we get the system down, I'm sure we'll reap economies of scale, and claim a lot of first mover advantages."

"Oh, but is there a risk that some customers might be turned off by the new blackmail feature? Would retention become a problem?"

"Doubtless no. Once they realize any ISP can blackmail them, they'll hardly want to tell any other ISP what they're up to. I have a feeling this will make them customers for life."

"Sounds great Ted. Have you even found any downside risks? I can hardly imagine any."

"Well, if just one of our third of customers tells the police, we'll probably all go to jail and our company will be destroyed by the scandal."

"Is that all?"

"The class action lawsuits, but legal is still working out projections there, so it's probably not a serious consideration."

"Well that's easy Ted, we just need to convince people not to tell the police. What's your plan for that?"

"That's the beauty, sir. Once we're experts at blackmail, we can convince people to do whatever we want just with more blackmail. It would definitely be a core competency at that stage."


While amusing (and well-written), the real risk is when the data spreads beyond the control of the ISP.

"It looks like we're going to miss our growth target. I want my bonus, so find something that looks like a new source of revenue."

"We could sell the tracking data we've been collecting."

"Aren't we already selling indirect access to that data through our 'Relevant Mobile Advertising'[1] program? We won't be able to sell the tracking data piecemeal if we sell the entire database."

"That won't be a problem. We'll just add more Magic Crypto Pixie Dust[2]. If anybody complains, we can explain that we are protecting them by carefully hashing any personal identifying information."

"Great! That will hold any problems until after I get may bonus. When someone finally correlates the hashes with other databases, that will be Someone Else's Problem."

[... time passes ...]

-- A religious fundamentalist in a very rural setting is trying about using databases.

"The news said that the only job left is moving the stuff on old computers to something they called 'big data'."

-- After getting a job migrating legacy databases, the fundamentalist discovers that the database they are tasked with loading into ${fad_analysis_tool} includes pornography viewing histories.

"Finally! With this data we can identify the people that are secretly ${socially_disliked_group}. We can finally eradicate all of ${socially_disliked_group} from the gene pool! The sinners must be purged!"

-- Everyone learns to resolve problems with words instead of violence. Our differences start to be seen as opportunities instead of a threat to the in-group. Listening to other people's opinions becomes the national pastime.

[1] https://www.verizonwireless.com/support/unique-identifier-he...

[2] https://projectbullrun.org/surveillance/2015/video-2015.html...


>While amusing (and well-written), the real risk is when the data spreads beyond the control of the ISP.

Everyone watches porn, so what is the risk? I can't imagine being judged by or wanting to work with anybody who cared about such matters.

That said, I'm from a "Western" country, so YMMV.


I chuckled so much after reading the last line in your dialogue that my mouse pointer took a good 2 seconds before accurately finding the upvote arrow.


Blackmail would be completely against their own interests. They make a lot more money selling information about you to other parties.

However.....

Extremist and oppressive governments, like the United States under the guises of intelligence organizations like the FBI, CIA & NSA, can, have and do use information like this to blackmail private individuals. And they buy the information from private corporations that track individual users. [1] [2]

Outside of our own country's influence, there are many nations around the world, and states therein, where things like homosexuality are outlawed, sometimes to the point of the death penalty. It's certainly likely that information like this, if collected by a severe enough regime, could use it to repress its citizens.

Speaking of which - during the "Lavender Scare" of the 1950s , a massive witch hunt and firings of suspected homosexuals in the private and public sectors chilled the rights of individuals with a particular sexual orientation. It's doubtless that Joseph McCarthy would have relied on J. Edgar Hoover's illegal methods of information gathering and intimidation to harass and persecute those seen as a threat to moral or political righteousness.

--

But like I said originally, none of that makes any sense in a capitalist fashion, because blackmail isn't sustainable. It's much more profitable and less messy to simply sell the pictures to the blackmailer.

[1] Top-Secret Document Reveals NSA Spied On Porn Habits As Part Of Plan To Discredit ‘Radicalizers’ (http://www.huffingtonpost.com/2013/11/26/nsa-porn-muslims_n_...)

[2] FBI's "Suicide Letter" to Dr. Martin Luther King, Jr., and the Dangers of Unchecked Surveillance (https://www.eff.org/deeplinks/2014/11/fbis-suicide-letter-dr...)


> the FBI, CIA & NSA, can, have and do use information like this to blackmail private individuals.

Aka "COINTELPRO"[1]. Surveillance technology and modern analysis techniques lets you estimate future leaders or sources of influence. If those people are removed from their position of influence early, the full revolution that might challenges the status quo never happens.

> none of that makes any sense in a capitalist fashion

It does if you add a layer (or several layers) of indirection. The company sells the information to some other org, the 2nd org (which could be the government) then sees the information as an expense, not a source of revenue.

[1] https://en.wikipedia.org/wiki/COINTELPRO


How would you infer which video in particular a person watches? The connection between you and the porn site is encrypted. For sure they can tell if you visited a particular site (asianmilfporn.com) and for how long but they can't tell which videos you viewed. They can't tell which videos are on your hard drive either.

Of course, the website itself would know exactly what you watched and would remember that as long as you used the same device to access the site.


> The connection between you and the porn site is encrypted.

Very rarely. Most popular pages actually either never provided, or disabled https after partial tests. And even with the site itself served over https, the content cames from CDNs which almost never use encryption.

At least that's what I found out with a quick review. The https everywhere extension listed xhamster https support as experimental/partial for a long time.


This may be true, but if someone is trying to blackmail you from (legal) porn sites you've visited, you're either in the wrong profession or you have some kind of false impression that most of the rest of (male?) society has never visited those sites.


>is this the kind of person you want near your children?

Let he who is without sin cast the first stone.

It sounds cliche, but everyone has their dirty little porn secrets. 95% of the porn I see out there I consider "weird". But there it is, so who am I to judge?


The fact that you watch a specific kind of porn.


This is why you should watch all the different kinds.


that's been my strategy. at first there was a lot of stuff i didn't like, but mostly all that has grown on me. mostly.


If it exists and is easily accessible, you're not alone.


Xhamster uses https!

Which is great, because my ISP doesn't learn of my interest in German-language fetish videos. Ja! JA!


HTTPS or no, your ISP knows that you visit porn sites. I mean, come on -- it's not like you were visiting some encrypted path on xhamster.com for the articles, right?


Assuming that you have a private DNS server, with HTTPS they'll only know that you visited an IP that points to xHamster... your browser only requests for a path after a secure connection is established. (http://stackoverflow.com/a/8858241/1979475)

The only way to get around the IP problem is to use a VPN or Tor.


> with HTTPS they'll only know that you visited an IP that points to xHamster

And what domain you requested specifically. SNI extension sends it in plaintext.


Ahh... Thanks! I missed that.


"I only buy it for the stories!" - Every Playboy magazine subscriber ever


In that case it seems beeg (NSFW) must be one of the best sites for this purpose. No registration and uses https.


Does anybody know the background of this site? It appears to exist solely as free, relatively high quality hosting for studio releases. What are the studios getting out of this? Is this site running legal content? What is the revenue model?


My guess is that studios are losing the war against tube sites, and they'd rather work with one that guarantees that videos have watermarks and a link back to their site.


> 2. register to a new google account

Is Google back to no longer requiring a phone number for signup?


you register into pornsites?


i can hardly imagine in what situation i would register an account on such sites using a cooperate email address... I mean, not only that i would expect those to be property of my employer (including mails sent and received that is) and thus potentially monitored for whatever reasons but i would also fear to get their brand into a situation like this.

I wonder if these people never considered to have a separate private mail address and what might be the reason for that.


I guess it could be for the same reason people reuse the same password everywhere --- convenience. And if the masses' reactions to things like Snowden, NSA, etc. are any indication, a lot of people just don't care whether they're being watched.


I don't know why anybody would register for a porn site just to comment. And, even if you do want to register, you can use any temporary email provider to keep your real emails safe.

The best one out there is http://mytemp.email , I use it almost every day, sometimes for newsletters and sometimes to check product trials.

Seriously guys, people really register on porn sites?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: