Pornhub extorted after hackers steal Premium member activity data
Posted by coloneltcb 13 hours ago
Comments
Comment by alsetmusic 8 hours ago
Now, if I was a repressed person living in an area where that threatened my safety, I'd be terrified. It's a privilege that I don't have to worry about it, and that's the real problem when we get past the technical reasons why this shouldn't have happened.
Comment by mitthrowaway2 6 hours ago
Comment by nonameiguess 6 minutes ago
Comment by Griffinsauce 5 hours ago
I know it's some sort of "trustworthiness" but that is objectively complete bs.
Comment by rgmerk 4 hours ago
https://www.theguardian.com/us-news/2023/nov/06/speaker-mike...
Comment by gessha 5 hours ago
Comment by AlecSchueler 1 hour ago
You're also lucky to live somewhere where you wouldn't face job loss, familial estrangement or even anything up to capital punishment for it.
Comment by qingcharles 1 hour ago
Comment by mystraline 8 hours ago
Thats a problem as well. Right now, you're 'safe'. But having that data available attached to you can also be dangerous to you in the future.
For example, the current wave of trans-hate can easily show you as a sympathizer. That can be criminalized quite easily, given 1/4 of the country hates trans people existing.
Being gay is right now not a crime in the USA, but it has been. And many regressive countries, predominantly Muslim, also have strong punishments for gay actions. Again, this material could easily be proof of a "deviant lifestyle" and legal punishments.
No, if I consume porn, I download from Piratebay, or hop on VPN and not login. And given I live in a state that Pornhub banned due to onerous age verification/identity tying, the whatif above could easily become true. Ive read Project2025 and saw those exact plans.
Comment by defrost 6 hours ago
For accuracy it's worth stating this is only a recent occurrence.
Right now:
Nations with anti-LGBT laws: 50% Muslim, 44% Christian (2024)
Half (33) of the world’s 66 countries that have anti-LGBT laws are nations where a majority of the citizens are Muslims.
By comparison, 29 Christian-majority countries account for 44 percent of the countries that still have anti-LGBT laws on their books.
~ https://76crimes.com/2024/02/11/nations-with-anti-lgbt-laws-...However this "predominantly Muslim" twist in the numbers is recent:
In recent years, the number of Christian-majority nations with anti-homosexuality laws has shrunk, both through court rulings (Barbados, St. Kitts and Nevis and Antigua and Barbuda in 2022; Trinidad in 2018; Belize in 2016) and through legislative action (Cook Islands in 2023, Singapore in 2022, Angola and Botswana in 2019, Seychelles and Nauru in 2016, Mozambique, São Tomé and Príncipe, and Palau in 2014).
~ (quote from above source)Uganda, with an 82% Christian population is famously severe in it's punishments for gay and queer sexual activity.
With the support and funding of US conservative Christians:
US religious right at center of anti-LGBTQ+ message pushed around the world
~ https://www.theguardian.com/world/2023/jul/09/us-religious-r...
Comment by pdpi 4 hours ago
This statistic makes the exact opposite of the point you're trying to make, though.
Going through this table[0], and provided I didn't make any dumb mistakes with my JS, there's 122 Christian majority countries, but only 54 countries are Muslim majority. So 33 out 54 Muslim majority countries have anti-gay laws, compared to only 29 out of 122 Christian majority countries with such laws. (The more interesting comparison would perhaps be counting number of people rather than countries, though, and it still says nothing of the severity of said laws).
0. https://en.wikipedia.org/wiki/Religions_by_country#2020_Pew_...
Comment by ethagnawl 7 hours ago
I'll need to dig up a reference but I've seen multiple sources cite that that 1/4 watches a disproportionately high amount of trans porn. The top most commenter is spot on about how much harm our prudishness is doing to us all.
Comment by mmooss 7 hours ago
That doesn't mean they don't hate trans people. Most porn shows women yet it's a hotbed of misogyny.
Comment by dragonwriter 4 hours ago
Comment by WillPostForFood 7 hours ago
How exactly could trans sympathy be "criminalized"?
Comment by why-o-why 3 hours ago
https://www.advocate.com/politics/pam-bondi-trans-equality-b...
Comment by nkrisc 7 hours ago
Comment by dragonwriter 5 hours ago
I mean, that makes as much sense as declaring an idea like antifascism a terrorist organization, which is clearly impossible.
Comment by protocolture 4 hours ago
After the fight, the brawl was blamed on the other participants, all of whom were wearing emo clothing. Black shirts, band logos, jeans.
The local police went as far as enacting a local anti gang ordnace, identified the emo wear as gang colours, and with 2 hours notice, advised that those colours were not allowed in the city for 48 hours. The security guard who helped break things up was chatting to me about it, laughing at it like it was a common consequence.
A local taxi company was cleaning up, as they accepted each emo kid, in groups of 1 - 4 and took them home to the suburbs. 20 taxis lined up, picking up kids.
Probably my first political WOW moment. I had never seen ~120 people pay for the consequences of the actions of a few.
True to their word, was 48 hours or more until I spotted them in the city again.
Governments can make any law they wish, cops tend to enforce any law they wish. Courts and appeals take time. There is nothing preventing that same city from declaring pride flags or trans icons as gang symbols.
This wasnt even in the US.
Same shit could happen anywhere, Trump could declare them terrorists identified by their symbols and tattoos, he could enforce inspections of their social media at airport checkpoints. Considering what was legal and enforced in the US in its history there's really nothing off the table going forward for persecuting anyone.
Comment by stronglikedan 6 hours ago
Comment by rsynnott 42 minutes ago
Comment by mmh0000 6 hours ago
https://en.wikipedia.org/wiki/Persecution_of_transgender_peo...
https://www.them.us/story/trump-admin-fbi-trans-nihilistic-v...
Comment by hiddencost 6 hours ago
Comment by mmh0000 7 hours ago
https://en.wikipedia.org/wiki/Capital_punishment_for_homosex...
Comment by WillPostForFood 5 hours ago
1: would be easy
2: would apply to sympathizers
3: would be possible
Comment by sapphicsnail 4 hours ago
Comment by neilv 9 hours ago
Comment by xethos 9 hours ago
In other words, this is data we as consumers want to be able to access, and therefore want kept.
Comment by afavour 7 hours ago
Comment by mmooss 5 hours ago
Comment by MangoToupe 9 hours ago
Surely this is up to the client, or perhaps explicit bookmarking capabilities. Not implicit records of what you looked for in the past
Comment by dkokelley 9 hours ago
Comment by ryandrake 9 hours ago
If companies actually think "users really, really want X" then they should have no fear making X opt-in.
Comment by zamadatix 8 hours ago
But there are obviously MANY things we prefer to keep opt-in. E.g. sharing my recents data with 3rd party advertises. No need to throw the baby out with the bath water and make every service awful by default just to have a universal rule to quote though.
Comment by bayesnet 8 hours ago
Comment by schoen 9 hours ago
Comment by yakshaving_jgt 8 hours ago
Brilliant talk.
Comment by TheCraiggers 5 hours ago
Comment by Nextgrid 9 hours ago
Comment by neilv 8 hours ago
https://en.wikipedia.org/wiki/Bork_tapes
> The subsequent leakage and coverage of the tapes resulted in Congress passing the Video Privacy Protection Act (VPPA), which forbids the sharing of video tape rental information, amidst a bipartisan consensus on intellectual privacy.[8][9][10] Proponents of the VPPA, including Senator Patrick Leahy, contended that the leakage of Bork's tapes was an outrage.[11][12] The bill was passed in just over a year after the incident.[13][14]
Comment by mc32 7 hours ago
That said, if I were to imagine myself working at a place like that when they existed, I can't see myself turning over customer data like that willy-nilly to someone fishing for information. Like are you the police, what gives?
Comment by le-mark 8 hours ago
Comment by newspaper1 8 hours ago
Comment by dyl000 27 minutes ago
Comment by rurban 4 minutes ago
Comment by rjdj377dhabsn 7 hours ago
The amount and variety of free porn is already enormous.
Comment by r0m4n0 5 hours ago
Comment by dieselgate 2 hours ago
Comment by D-Machine 5 hours ago
EDIT: Best argument for paying for porn is to support the performers, but paying for a generic porn streaming service hardly seems the best way to do this.
Comment by lisp2240 5 hours ago
Comment by Beijinger 4 hours ago
Comment by D-Machine 4 hours ago
Comment by adithyassekhar 1 hour ago
Comment by rkagerer 4 hours ago
I always teach companies to treat user information as somewhat toxic (i.e. a liability). Search and view history... it doesn't get much more personal than this.
Comment by cmiles8 12 hours ago
Comment by jfindper 11 hours ago
I had an inkling! They've been on a roll this past year or so.
>This data includes a PornHub Premium member's email address, activity type, location, video URL, video name, keywords associated with the video, and the time the event occurred.
Well, that's pretty fucking wild! Email address & time and location sent to a 3rd party, nice! Absolutely no reason for that, of course. Especially considering these are paying customers!
I guess somewhat notably is Mixpanel denying that it's coming from their November breach. They have less incentive to lie in this case, given that they've already admitted to being breached, and (presumably) their systems & logs have been gone over with a fine-toothed comb to identify all affected parties:
>"The data was last accessed by a legitimate employee account at Pornhub’s parent company in 2023. If this data is in the hands of an unauthorized party, we do not believe that is the result of a security incident at Mixpanel."
Comment by reorder9695 10 hours ago
Comment by arealaccount 10 hours ago
Comment by dredmorbius 10 hours ago
Comment by mywittyname 10 hours ago
Comment by jorvi 9 hours ago
There is no reason to think that more reputable activist providers like Mullvad or AirVPN would if a party like PIA already doesn't.
I'd steer clear of NordVPN though. They have lots of controversy in their history and they are very financially motivated, considering the deluge of YouTube sponsorship and ads they pay for each year. Still don't think they would lie about no logs but why risk it.
Comment by Bender 8 hours ago
Did they also testify under oath there is no lawful intercept API or anything similar? That does not require logs. In fact when the feds would set up phone call intercepts on telco switches we would intentionally disable logs and put the mainframes into "test mode". And that is even before people start playing legal word games like calling lawful intercept "debugging" or something else. Lavabit [1] found out what happens if lawful intercept is not available.
Just me personally, I would always assume a service I do not entirely control and operate is doing what it can to comply with lawful intercept requirements and they are likely playing word games to not drive away their members and I would not blame them. I am just the properly paranoid type in part due to a good upbringing by a properly paranoid person.
Comment by bloomingeek 5 hours ago
I say you've properly got your eyes open. Anyone who thinks anything you do online is completely private is naive. IF any government wants to know what you've been up to online, nothing can stop them. Privacy is a thing of the past, we should vote only for politicians who say they want the government out of our backyards, banks and bedroom. Oops, too late!
Comment by belorn 9 hours ago
So if any calls looks like "https://example.invalid/api?confirmemail=user@example.invali..." would cause a leak of the email. I have seen multiple companies and websites do this (either with email or username) when signing up or after first login, and I would strongly guess that most of not all of them uses some kind of analytics for that request that leaked data.
Web developers are supposed to scrub their sites so that doesn't happen, but then the main arguments in favor of using third-party analytics is the convenience of enabling it globally with minimum effort and then getting pretty graphs for free. There are occasionally HN posts about self-hosting analytics and the common response is that its too hard and too much work.
Comment by wzm 10 hours ago
3rd party user tracking can slurp up a lot of unexpected data, and no one ever wants to disclose problems when a vendor loses things like this. MixPanel has a long history of problems/
Comment by tyre 10 hours ago
Comment by jfindper 10 hours ago
They may need to retain certain information for laws, but they aren't obligated by law to also share that information with their analytics partners.
Comment by znpy 11 hours ago
I had always known, albeit intuitively, that registering to porn websites was a dumb idea.
Time has proved me right.
Comment by dredmorbius 10 hours ago
<https://www.wnycstudios.org/podcasts/otm/segments/what-can-w...> (audio and transcript).
Based on Paul Ford's blog entry: "Fairly Random Thoughts on Ashley Madison & the Swiftly Moving Line" <https://medium.com/message/fairly-random-thoughts-on-ashley-...>.
Comment by nephihaha 10 hours ago
Comment by bena 10 hours ago
Getting compromised is more of a matter or time than ability. Someone's going to fuck up at some point.
Comment by darth_avocado 10 hours ago
Comment by nullorempty 9 hours ago
Comment by aussieguy1234 9 hours ago
In the case of personal emails, that same email can usually be used to look up the victim on social media (Facebook is an example) to reveal their identity, if, like most people, they used the same email on that social media site.
As most on HN will be aware, data breaches like this are extremely common. Its not a matter of if, its a matter of when. NSFW sites in particular are more juicy targets and often have bad security.
Comment by rgmerk 4 hours ago
Comment by userbinator 6 hours ago
Unless you actually work in the adult entertainment industry, that seems like a massively stupid move; one that would likely lead to termination.
Comment by technion 3 hours ago
Comment by NetOpWibby 7 hours ago
Comment by temptemptemp111 11 hours ago
Comment by hereme888 6 hours ago
Comment by b33j0r 21 minutes ago
* I know who you did last summer
* I know who you did last, Summer
* no fault divorce laws near me
Comment by nusl 12 hours ago
Comment by thuridas 11 hours ago
Just by replacing the email with a random anonymizedAccountId the impact would have been reduced from disaster to who cares. This was bad design from the start.
We may see some interesting news in a few days.
Comment by xp84 10 hours ago
Of course, in a sensitive situation such as that, even IP address can also be problematic, and your 3rd-party tracking software vendor gets that automatically.
If these clowns had hired someone smart instead of just copy-pasting some tracking code and throwing their whole user object at it or whatever, they would have given this some thought.
I'd have used the ability to proxy the MP tracking calls to my own server which most of these services offer but few use. That server would not keep any logs and would perform coarse GEOIP, remove the IP itself or zero the last 2 octets, and relay that information into MixPanel using custom attributes.
Just a quick back-of-napkin sketch, but even that was more thought than they put into it.
Comment by 8cvor6j844qw_d6 11 hours ago
Similar to Ashley Madison data breach, vulnerable to extortion and various shenanigans.
Comment by jimt1234 8 hours ago
Comment by NetOpWibby 7 hours ago
Enjoy the free show buddy