Slashdot Mirror
The Register Email Address Blunder
First time accepted submitter Tim99 writes "This morning I got an email from The Register informing me that they have sent 3,521 of their readers the names and e-mail addresses of 46,000 other readers. Considering their frequent rants about security this has got to be a major FAIL."
El Reg writes: "Obviously, this was an error. The two-stage send process that is the norm for all of our mailers was over-looked because someone was in a hurry."
"We are in the process of blowing the whistle on ourselves to the ICO over the matter."
"The dew has clearly fallen with a particularly sickening thud this morning"
They've put their money where their mouth is, and reported themselves to the Information Commisioner's Office for the breach.
No kidding!!! What do you say at this point?
Let us know when it's on there, k?
Seems like someone is overdue for a promotion...
The impacts of this on the Reg readers affected is probably fairly minimal. At worst, the volumes of spam headed towards certain e-mail addresses will increase. But then - how many people these days really use an e-mail address for their website-registrations that they don't expect to be a complete spam-magnet anyway.
But there's no credit card info out there, no real-world addresses or telephone numbers. And having an account with The Register isn't the kind of thing that people tend to lose their jobs over, so nobody need be particularly embarrassed about their name being on the list (unlike, say, when the British National Party's membership list was leaked a while back).
This is far worse for The Register itself. It has - quite rightly - been a prominent critic of companies or organisations who fail to protect personal data. And now - even though the breach is at the lowest end of the severity scale - it's gone and done it itself. Fairly or not (and it's probably not, since I doubt it was one of the actual writers who was responsible for this), their own credibility is tarnished.
UK readers may remember Angus Deayton of Have I Got News For You fame. I can see the potential for similar consequences here...
I never understood the big deal of what Angus Deayton did (http://en.wikipedia.org/wiki/Angus_Deayton), he was a TV presenter on post watershed TV. What he does in his private life has sod all to do with that. It just goes to show what a pair of twats Merton and Hislop really are (if it were ever in question).
Well, it seems likely that some register users will be getting a lot of spam soon. Even if the list didn't get sent directly to a spammer it might have gone to someone who wants to teach the Register an important lesson.
I always use disposable addresses when signing up for anything, and even give them to my friends. I've had one Linux forum make my address publicly visible. I've had multiple vendors send out things to lists with CC information in plain sight. I've had friends who had their accounts hacked and their contact information harvested. Always using disposable addresses lets you cut off just the problem rather than having to abandon an entire e-mail account (which I had to do years ago when it suddenly started receiving hundreds of e-mails a day, so much that my normal e-mail was being rejected because my "mailbox was full")..
I use a great free service from Spamgourmet.com. I have no relationship with them other than being a satisfied user for many years. As far as I know my actual e-mail (which I obviously had to give to them for forwarding) has never been compromised or leaked and I've never received any form of junk mail from them. They are not the only such option, but whichever you choose to use you should definitely use one if you want to protect yourself from spam and worse.
I'm an American. I love this country and the freedoms that we used to have.
So did someone put all those names and email addresses into the To or Cc field of an email? That would be a rather large email to receive!!!
In addition, this is why proper mailer software that they should have used handles the email composition and sending internally - so that the addresses will be in the BCC field or each address will get its own email sent just for itself.
If they just sent out an excel file with the details in, that's even worse. There is no excuse for a workflow that involves someone manually getting a particular list of recipients from a CRM and then emailing that file in any way. Unless you have five employees.
So ... how does this happen still? Stupidity and poor IT workflows.
If he'd stayed, then for years to come, every time he tried to mock any of his guests over their own indiscretions, they could just have turned the tables on him. HIGNIFY has always had a degree of "yah boo sucks" about it - it's not exactly reasoned debate - and this would have amounted to a get-out-of-jail-free card for guests. Having the show run on that basis in the long run would have robbed it of most of its impact.
On the other hand, they probably confessed their error in record time. There can be no claims of downplaying or sweeping things under the rug that usually accompany reports of a data breech.
This is far worse for The Register itself. It has - quite rightly - been a prominent critic of companies or organisations who fail to protect personal data. And now - even though the breach is at the lowest end of the severity scale - it's gone and done it itself. Fairly or not (and it's probably not, since I doubt it was one of the actual writers who was responsible for this), their own credibility is tarnished.
Back when I read The Reg, they seemed to use humorous self-deprecation to deflect any and all criticism (slightly like Private Eye or Mad Magazine). This was back when Wikipedia was relatively new and controversial, and there would regularly be exchanges along the lines of:
Reg article: "'Pediaphile makes mistake in article, proves Wikipedia is shit and wiki-fiddlers are all cocks".
Reader email: "But the Reg is full of factual errors..."
Reg response: "Yeah hurr hurr we're just a bunch of boozy old hacks in it for shits and giggles, what did you think we were a proper news site you big spastic?"
At which point I started wondering why the hell I was reading a website which was neither informative nor entertaining. Still, the Sun is the UK's most popular newspaper with no support from me, and I'm sure El Reg are doing very well without my eyeballs too.
Yep. They handled it about as well as as is possible, I thought.
...struck again >>
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
as mentioned in the comments, somebody uploaded a link to a site hosting the file with the addresses. Which is nice because then you can check if your name is on it (mine isn't). For those whose name is on it, it's not so nice, but that's a different story...
Windows 2000 - from the guys who brought us edlin
Comment removed based on user account deletion
"Mistakes will happen", "I thought they handled the screw-up exceptionally well",
"They've put their money where their mouth is", "they deserve credit for that",
"The impacts of this on the Reg readers affected is probably fairly minimal".
Anybody else did this and the reactions would be much different. I figure the Register
has called in everybody they can for damage control.
I've read the Register for while when they were hacked and down for a full weekend
just recently, I went to the site Monday and not one word about it was posted.
Disposable addresses - do support www.bugmenot.com by adding a name and password when you can.
I don't know why. I received the entire list, I am only on it once. At least it was only names & email addresses — could have been worse.
I was one of the 3,521 who received the email with all 46,000 addresses in the CC field.
It was followed up by an apologetic email explaining what had happened and asking me to delete the original email; and another email sent to all 46,000, again apologising and explaining, and linking to the press release. The Register also promptly reported themselves to the ICO.
My first question to them was 'What mass mailing software or service do you use, and why did it allow this?' Considering the (assumed) IT literacy of The Register's staff, I hope they're at least using some semi-competent service, and not some home-brewed PHP script running a SQL query. They haven't answered this yet.
However, at least they have been honest and apologetic about it - this isn't the first time I've received mass CC'd emails from legitimate businesses, and usually they're a) unaware of it and b) don't really care even when I point it out. Always surprising considering how tight data protection laws are in Europe. (Maybe it's one of those pesky interfering European laws that the Tories want to get rid of, to let good old honest British spammers return to their traditional methods)
Anyway, I haven't deleted the email yet, but will be soon. While I have NO intention of sharing or using the 46k addresses (and have been impressed so far with the lack of replies from any of the other 3,521 along the lines of 'LOLZ!! EL REG FAIL!'), I might do some data analysis (eg. how many use each popular email service, what proportion use throw-away or site-specific addresses, how many apparently use real names) - any suggestions?
I was one of the 46,000...I also was one of the 3,000 that received all 46,000 names and email addresses.
The email subject "ON DEMAND: Clouds for hire" itself was quite odd - the details weren't in a CC or To field, it was just a list of "firstname, surname ".
TBH I'm not hugely bothered, The Register sent an apologetic email requesting that I delete the email, which I did.
Big mistake, correctly handled and mistakes will happen.
As (I assume) an average Reg reader I don't really give much of a toss if my login's compromised. The email account was probably disposable and I can always make a new login if I want to comment. I've looked through the list and can't see myself (or anything that looks like the sort of online ID I'd use) there, and given that I've forgotten my details I'll probably need to create a new account anyway... Yup, they look a bit daft from this. The self-reporting to the ICO is certainly a Good Thing.
Oh arse
"Fail" is not a noun. The word you are looking for is "failure".
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
...that you people consider names and email addresses secrets. Even more "amazing" is that you would use such secret names and addresses to sign up on a free humor Web site.
Hint (yes, again): to keep a secret don't reveal it to anyone without
a) A need to know
and
b) A contractual obligation to keep it confidential.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
The Register has investigative reporters and aggressive editors. If they were able to diagnose the problems in other companies data systems, how come they were so blind to what was happening in their own organisation.
And how crass not to accept blame as an organisation, but to put the blame on an individual employee. They would ridicule any other company that tried to deflect blame this way.
What I find more interesting is they posted an email address which they claim goes to the person who screwed up. It's obviously an alias created for the occasion, but it still might actually go to that person. If it does, that shows a measure of accountability that is almost unheard of these days.
Of course, it might also just go to the bitbucket.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
Well there's that. And also the fact that their main assert is Paul Merton, and he couldn't stand the sight of Angus.
So I logged into Hotmail and yes, there was the apology buried in all the spam
I was amused to see that 10 days earlier Register Marketing had sent me a mail entitled...
ON-DEMAND : The security mistakes users make
Social networks, local admins, unlatched software, missing USBs: the
causes of security problems in your business are often not just the big
stuff that tries to get inside the firewall, it's the little problems
that are already on the inside. Could your traditional security
architecture be solving the wrong problems? Would a new approach plug
the gaps more efficiently, and how much do we need to trust and train
our users?
That's what our latest Regcast considers.
(My emphasis). Sounds like one not miss.
Comment removed based on user account deletion
But what do they know about the English language?
Chaucer: Comaunded hire massangerys for to go The same day with outyn any fayle.
Shakespeare: How grounded hee his Title to the Crowne Vpon our faile.
Coincidentally, the Oxford English Dictionary agrees with Chaucer and Shakespeare.
Can someone comment on what the "two-stage send" policy is?
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
Why would anyone give their email address to The Register anyway? You can read it without registering. At most this probably makes people more nervous about the "you must register to read our pithy articles" sites and instead head to places like The Register instead.
1) Store passwords in plain text (test with the "I've lost my password" function).
2) Tell anybody whether or not an email address maps to an account (test by logging in with the wrong password).
. . . which would have exposed the stupidity (or inebriation) the guests who don't pick up their GOoJF card.
Oh, I don't know ; I enjoyed seeing Merton put the (be-cramponned) boot into Deayton. A more justifiable bloodsport than fox hunting, and you can do it again next week. Cross-reference : Stephen Fry feasting on Alan Davies' liver every week.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
Ref. previous comment about Stephen Fry Promethean relationship with Alan Davies on QI.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
Fry/Davies is obviously in good humour. You can tell they like each other.
Deaton/Merton had not been in good humour for years before Deaton got the boot. Yes it was funny, but sometimes uncomfortable. And certainly very uncomfortable in the last show or two.
Talking of which, I really don't think the different presenter each week works. Sometimes they have a good or interesting one, but then that's balanced out by the uninteresting or just useless ones. Mostly it just ruins the illusion that the presenter is speaking for him/herself. And I don't find that to be a good thing. Yes, everyone knows that writers always did the presenter's patter and jokes. But there's such a thing as willing suspension of disbelief.
You only need to register if you want to join the esteemed ranks of Register commentards and comment on their articles.