Social Search Reveals 700 Comcast Customer Logins

nandemoari writes "When educational technology specialist Kevin Andreyo recently read a report on people search engines, he decided to conduct a little 'people search' on himself. Andreyo did not expect to find much — so, imagine the surprise when he uncovered the user name and password to his Comcast Internet account, put out there for the entire online world to see. In addition to his personal information, Andreyo also discovered a list that exposed the user names and passwords of (what he believed) to be 8,000 other Comcast customers. Andreyo immediately contacted both Comcast and the FBI, hoping to find the ones responsible for divulging such personal information to the public. While the list is no longer available online, analysts fear that the document still lives on in various cache and online history services."

Comcast has Passwords?

[westyvw]

Who knew? Are these the same people who actually let Comcast install software on thier computers?

--Nothing to do with the leak of passwords, just saying.....

Re:Comcast has Passwords?

[JWSmythe]

    I've moved around a lot, and each time they've tried. They've also been insistent that I have a Windows machine for them to install with. I used to keep a spare Windows box handy just for the installs. Usually I could talk them out of touching the machine. Two insisted, and finally made me sign a waiver that I refused, but the connection worked so I didn't care. One blatantly refused to do the install without putting the CD in. I was happy that it was a spare machine I didn't care about. It came offline, and I put my Linux machine up just after they walked out the door. It had a nice clean install of Win98 on it, so they got absolutely no personal information. I wiped it later on, just in case I needed it again for something.

   

I haxxored Comcast...

[feepness]

So I'm trying to log on to Comcast to look at my bill. It's one of those places you log on every three years or so, so I can't remember anything about the account. I gave them my name and they give me a secret question asking "What is your favorite drink?" Well who the hell has a special favorite drink? So I plug in a few answers and finally try "milk". Bingo, I'm in. Change the password to my standard website name hash, poke around, get confused, and realize... wait a second... this isn't my account. My name is fairly rare, but I guess not rare enough. I don't really have any way of resetting it to what it was before, and for some reason there was no email verification involved. So I whistled quietly as I closed the window and called customer service instead.

Slashdotted...

[rockNme2349]

I can't seem to find the link to the page with the passwords, seems their servers weren't up to slashdot.
Can someone post google cache link please?

Re:Slashdotted...

[Hal_Porter]

I shall notify the people who have critically weak passwords by email.

Re:Comcast has Passwords?

[Lord Ender]

While Time Warner, the local cable company, has never tried to force me to install their crapware; if they tried, I would have no trouble handing them my netbook (which lacks an optical drive).

Re:I haxxored Comcast...

[Ironica]

Not completely secure if the attacker knows your hash function but I longer low hangng fruit

Or you could just use the last five words as your secret passphrase, and no one would ever get it because it's apparently a totally random combination of words and letters.