Slashdot Mirror
Disqus Bug Deanonymizes Commenters
alphatel writes "The Swedish company Resarchgruppen has discovered a flaw in the Disqus commenting system, enabling them to identify Disqus users by their e-mail addresses. The crack was done in cooperation with the Bonnier Group tabloid Expressen, in order to reveal politicians commenting on Swedish hate speech-sites."
Damn, so my anonymous.coward@mailinator.com is compromised?
But seriously, who uses a real email address to register anywhere?
Expressen could have just disabled Disqus on their own site and they would have full access to IPs and e-mails of users commenting on their hatespeech site.
9/11: Never forget it was a false-flag operation
From me here.
anonymous@coward.com
I've always used my real name when commenting, or (in the case of places like Slashdot) made it easy to find my real name. For decades now. There are a couple posts on Usenet I'm embarrassed about (for example, I got my signs reversed trying to explain the link between electricity, magnetism, and Relativity once) but nothing I would be uncomfortable if a prospective employer saw, or appearing on the front page of the newpaper.
PHEM - party like it's 1997-2003!
One company being able to build up a collection your comments and opinions across multiple websites.... Thank goodness I only comment on Slahsdot
In Europe we have an increasing problem with racism and hate speech, especially on anonymous internet forums. This is one of the few jounalistic method that actually works, so I congratulate Researchgruppen on their success. Most of the haters that were reveiled and confronted this way were politicians from the racist "Sweden Demoncrats" party, but additionally some company execs and other privileged persons were scrutinized.
The NSA maintains a log of your comments posted on disqus, facebook, twitter, slashdot, reddit, google+, etc. Do you know why Barack Obama changed his mind about the NSA after he was elected? Do you know why Diane Feinstein doesn't care what they do? Do you know why FISA judges rubberstamp everything they do?
The NSA has files on all of them. Coincidence?
Do you even lift?
These aren't the 'roids you're looking for.
I'm pretty sure some people will have a problem with your wholesale slaughter in Viet Nam.
Those who don't will surely disapprove of you shamelessly displaying your big blue dong all over the internet.
The original topic poster wrote it like what they did was for a good purpose. While I might like journalists to do investigations of politicians I dislike bursting peoples trust in anonymity.
Some drink at the fountain of knowledge. Others just gargle.
Foxnews.com uses Disqus, although im not certain the merit of pin-pointing racists, xenophobes and homophobes in america. people like Rick Santorum and Steve King can and do go around bashing gays and muslims respectively with little social repercussion. Pamela Geller basically makes a career out of muslim bashing. Alaskas Don Young refers to south american and central american immigrants exclusively as wetbacks in his commentary on radio stations, and a sizeable number of our southern politicians have been card-carrying members of the KKK.
yet freedom of speech gets a good stretch here in america when its true definition was essentially political. In america, the first amendment guarantees your vocal objection to the agricultural policy of tom vilchek cannot result in riot police kicking in your door at 4 in the morning and beating you with riot batons in the street for your dissenting opinion. the freedom of religion granted us the right to organize against the government at a social level, as to deject the church in its occupation as a station of the government was in england considered nearly treasonous.
Good people go to bed earlier.
Every time I read some inflammatory piece of click bait that riles me up enough to post a response and the Discuss login pops up, I make a mental note not to return to that site and I close the tab.
Discus is bad for site owners, it gives an external entity control over their sites comments and therefore content.Discus is bad for users because it feeds tracking data about the user to an untrustworthy entity that does not need to be connected to the site.
Anybody that uses that shit deserves what they get. Maybe Slashdot should eliminate Anonymous Coward and throw up a Discus login. That would certainly end the First Post trolls.
Disqus has been blocked at my firewall for some time.
Not because of this, but because I was seeing it on so damned many sites it's not funny. Which means I didn't trust it to be anything good for me.
There's so much shit on the internet these days that if you're not using cookie/script/beacon blockers you're just handing over your information to a company for profit.
I believe every hacker on the planet should be working to release the private details of every company executive (and their families) involved in this stuff. If our personal information is a commodity, then don't act like yours is any different. Assholes.
Much like Zuckerfuck fiercely protects his privacy while undermining ours, you don't get to choose that your privacy is more important than mine.
Lost at C:>. Found at C.
Because there is no requirement to click on a link in an activation email when signing up, anyone can register anyones email and start commenting if they want to frame someone.
All of the conventional politicians are stuck trying to push a phony image in lockstep with Ameircan puritansim -- churchgoing, once-a-month missionary position and nothing more than a weak cup of coffee on a Saturday morning.
Since the lifestyles they actually lead involve mistresses, hookers, cocaine, whisky by the barrel, and all manner of shady business deals and votes-for-cash schemes, they are of course vulnerable to all kinds of blackmail by those who can collect the dossiers.
Rob Ford doesn't care. He's willing to admit he gets really fucked up and will try pretty much anything, including hittin' dat pipe 'till da rock is all gone.
We need more Rob Fords who just don't give a shit and aren't slaves to the petty morality of American culture.
... I have a separate e-mail account for commenting on the internet.
What they get is the MD5 of the hash, and THEN only if they have an emaila ddress to compare to they can do it. But that second step is not as easy, as , say having the email address in plain text. Although disquss should probably have salted anything privacy relevant frankly, it isn't as bad as a cursory reading of the summary make you think.
At first glance this immediately came to mind...
http://www.youtube.com/watch?v=KDwODbl3muE
Why wouldn't they have captured Disqus?
It seems like a logic attack vector...
At some point all those who ordered illegal substances, or services using bit coin will be found. With their secure digital signatures confirming they did the ordering. It will be fun when that happens.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Lots of sites I frequent use it and it's a *terrible* UI model for browsing and commenting on forums. It's slow, has a clunky UI, lacks features, and even WORSE they scrub comments religiously if you even remotely criticize the parent site or any of its prinicipals. I'm assuming Disqus is presenting hosts with a ridiculously cheap package for anyone to think it's a good idea.
Unless it's another Total Information Awareness tool and they don't *care* about how usable it is...
I swear to God...I swear to God! That is NOT how you treat your human!
Morals of the story:
don't leak hashes.
Salt the data before hashing
Don't trust any website to value your anonymity over their profits.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I'm willing to take the risk, and I was two decades ago, too. So far, it's paid off. I haven't had too much trouble finding places to work with a minimum of BS. I wasn't terrified when Google put Usenet online - but then, I'd always been polite when expressing my thoughts. If someone wants anonymity so they can be the "asshole", I find I have limited sympathy.
PHEM - party like it's 1997-2003!
Open your eyes man, the jews may seem in power, but that is only a clever decoy, the real power is in the hands of santa claus and his aliens from roswel. Though the illuminati and the macons are trying hard to regain the power from them (they lost it in 9/11 when all their upper staff got killed).
You confuse ANY-one and EVERY-one. ANY-one can be rich. ANY-one can do what you did. ANY-one can win the lottery. But if a certain threshold is reached that won't work any more, unless something fundamentally changes in the system (system in a "sciency" meaning), because whatever the current system is it allows only a certain amount of non-standard actions.
they did get the MD5 hashes from Disqus, from their api.
to know which e-mail address it belongs to, Expressen.se did generate MD5 hashes of all their e-mail addresses that they have in their (e-mail) system.
now they know which hash belongs to which e-mail address and can then continues the search for who his/she is what that specific MD5 hash.
Don't tell US what kind of children we should have! We'll choose whatever the hell we want! Some of us actually love our little mutants.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Actually, no. You are confusing the two.
The original question was, who uses a real email address to register anywhere?. (Rhetorically) implying that "EVERY-one" doesn't, or shouldn't, use their real identity on the Interwebs. I replied, pointing out that that's not the case - there are people that do, in fact, enter discussion with their real identiies.
I didn't claim (a) that "EVERY-one" does that, nor that (b) "EVERY-one" should do that, nor that (c) "EVERY-one" should be required to do that. I simply pointed out that (1) it's possible to do that, and (2) at least some people actually do that.
But you, apparently, think that if "ANY-one" does something, that automactially means "EVERY-one" should. To paraphrase Babbage, 'I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a conclusion'.
PHEM - party like it's 1997-2003!
Don't you dare click on the "Homepage" link next to every single one of my comments, you NSA spy!
PHEM - party like it's 1997-2003!
Use different email addresses for each service. You do it with passwords, why not emails?
See here.
PHEM - party like it's 1997-2003!
Indeed. If an employer is going to block you from an interview based on some random and fairly innocuous posting online, he/she is probably quite likely to nail you to the wall for something similarly petty in the workplace. The one difference being that oft-times the people doing the hiring are not necessarily the ones you'll be working with or directly for.
I can't think of too much online that would paint me in a terribly negative light. The worse being when I've called some people on being jerks (notably a LUG where members were filling my inbox with personal attacks and off-topic BS), and probably comments of a similar nature on slashdot.
You see no issue with the ipad baby sitter which damages mental and physical growth in infants? Implying or claiming that the people pushing for a recall of the device because of its harmful impact are "bad" people?
Your last paragraph is an appeal to emotion, which reads as a complete fabrication (and of course it's 2nd hand, so not verifiable).
Yeah, there are crazy people out there all right. If you were worried about people threatening you, I'm would have to consider that there is at least a bit of delusion involved in that thinking.
The only place I agree with you is that you should not hand out information to people. That kind of goes back to decades of child rearing, where you teach your kids not to talk to strangers.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Old curmudgeon here, but WTH is "deanonymizes"? Sounds like a sci-fi weapon - "Starbuck, what do you have left in your deanonymizer?" But I take from the article and discussion that it's about identifying folks who make anonymous comments. Jeez, ain't they no editors aroun' here anymo'?
I left Disqus when I noticed some of my posts had been literally disappeared without a trace. And my posts, while opinionated, were never ad hominem or hate speech or anything but apparently struck the wrong chord with some discussion participants.
I miss Usenet, where I always posted with my full name and email address. It was a perfectly good system—your posts weren't anybody's property and you could choose the UI of your liking.
Somehow that doe NOT surprise me. First clue.. CNN likes to use it.
"I learned my lesson well. You see, you can't please everyone, so you got to please yourself". - John Fogerty
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
okay, there are facebook comments and g+ comments, too.
Why are sites to stupid to use an own comment system? There are many ready-to-use systems.
https://github.com/django/django-contrib-comments/
One of the the Disqus commenters that where exposed just had a bomb thrown at his house.
http://translate.google.com/translate?hl=en&sl=sv&tl=en&u=http%3A%2F%2Fwww.expressen.se%2Fkvp%2Fbombattentat-hos-sd-politiker-i-arlov%2F&sandbox=1