Comment

Comment by ComputerGuru

kpumunk and others, please note that http://www.scribd.com/password/check leaks information about whether or not a particular email address is in your system. It's hardly a critical weakness or anything, but just an FYI and something you may wish to reevaluate.

Edit: thanks for the quick fix! I would advise that a good compromise would be to change the current message from

"Good news - your password was not among those compromised. You do not need to take any action at this time."

to

"Good news - if this is the email your Scribd account is associated with, your password was not among those compromised. You do not need to take any action at this time."

Small difference, but the lack of definiteness to the response will be enough to make me think of double-checking my email (in my case, it was an email address I haven't used in years - I'm one of the first Scribd users!)

parent ComputerGuru 13 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton