"Let's Encrypt" exposes almost 8K user email addresses
https://community.letsencrypt.org/t/email-address-disclosures-preliminary-report-june-11-2016/16867
The result was that recipients could see the email addresses
of other recipients. The problem was noticed and the system
was stopped after 7,618 out of approximately 383,000 emails
(1.9%) were sent. Each email mistakenly contained the email
addresses from the emails sent prior to it.
- - -
This kind of rudimentary error goes all the way back to early ARPANET
days. It really inspires confidence in the Let's Encrypt operation - NOT!
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
I have consulted to Google, but I am not currently
doing so -- my opinions expressed here are mine alone.
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
