Gregory's ServerNew scraped data: Duolingo had 2.6M records scraped from a vulnerable API earlier this year and posted to a hacking forum today. Data included name, email, username and learning progress. 100% were already in @haveibeenpwned. Read more: https://www.bleepingcomputer.com/news/security/scraped-data-of-26-million-duolingo-users-released-on-hacking-forum/
|
18 comments
 @FiveElementNinja @haveibeenpwned use an email alias and a random username and you're relatively safe, as long as you do not fall for phishing attempts yourself. @arh I do this for all these apps, I careful curate who gets my real name and email address. There's simply no need for them to know my real identity to use these services. @alessandrolai @haveibeenpwned > The API allows anyone [...] to feed an email address into the API and confirm if it is associated with a valid DuoLingo account. So any email address in the leak must've been leaked before or brute forced. I'd assume the scraper simply used leaks which were already public which would explain the 100% match against HIBP. @Ppampolim :( quando vou ao https://haveibeenpwned.com/ encontro sites q nem lembrava de algum dia ter usado.. @Bossito Eu deixei de me preocupar com casos destes porque, há alguns anos atrás passei a usar emails temporários e um gestor de contas/passwords. Mas não deixa de ser desagradável quando afeta alguma plataforma onde se investe tempo e esforço (como parece ser o teu caso com essa (pelo que leio dos teus posts sobre os resultados obtidos)). Nao vou ao haveibeenpwned.com/, nem sabia porque email procurar 😞 @Ppampolim pois é chato, mas não é culpa deles acho.. e nesse site o meu email não parece apanhado nessa fuga do duolingo. Se calhar pq eu acho q nem tenho conta direta com eles, sempre fiz o login com o gmail salvo erro. @haveibeenpwned Yeah that API did give you a lot of data, too much for users you are not even friends with. At least they admitted it. Did someone scab and submit the problem over hacker1, having to do data entry? @haveibeenpwned @Taco_lad I have no idea why I mentioned you in this, this client randomly picks up users and adds them sometimes  @haveibeenpwned NOOOOOO!!!!! Now every one can know how poorly my Finnish and Latin progress is! |
@haveibeenpwned even learning a new language is not secure... 😅
Rats...