• Sweden's news in English
 

Swedes uncover Disqus user security breach

Published: 12 Dec 2013 15:15 GMT+01:00

After outing several 'online haters' at home, which caused several resignations from the populist, far-right Sweden Democrat party, the Swedish investigative journalists behind the revelations said they had accessed the identities of several million commenters using the popular Disqus system.

Martin Fredriksson and his colleagues started collecting Disqus data back in February 2013 as part of a project to more closely analyze anonymous online comments. They hoped to understand more about who was behind hateful and racist comments on far-right websites in Sweden. They unearthed some 6,000 anonymous accounts in Sweden on commission from the tabloid Expressen, which published the data on Tuesday.

Fredriksson told The Local on Thursday that the unmasking of a few thousand users behind pseudonyms used on far-right sites in Sweden could just be the tip of the iceberg.

There were millions of Disqus users whose identity is at risk of exposure, said Fredriksson, responsible publisher (ansvarig utgivare) for the Research Group (Researchgruppen, who said his group's database contained a total of 29 million comments from Disqus users around the world.

"We used an open Disqus API protocol to obtain the data," he said, using a common acronym for "application protocol interface", which specifies how software components should interact with one another. In order to obtain the data more efficiently, Fredriksson wrote a programme that automated the data download requests sent to Disqus servers.

"You usually get around 100 comments with one request, but our system was able to send ten requests at once," he explained.

While the thrust of the research focused on far-right sites in Sweden, data was also collected from news sites elsewhere in the world, including CNN, The Telegraph, ABC News, and The Jerusalem Post, as well as from mainstream Swedish news site such as Svenska Dagbladet, SVT Debatt as well as The Local.

Members of the Research Group quickly realized, however, that the data they received also came with metadata that included the email addresses tied to anonymous Disqus accounts.

"It came as something as a shock," he said. "We got a lot of data we probably weren't supposed to get."

Fredriksson emphasized that the group didn't use any illicit methods in obtaining the data, but that the information was included in their trawl due to a security flaw at Disqus.

"When you leave a comment as a Disqus user, there is information about the date, username, and the comment itself which is open data," he said. "But (Disqus) also sent us data with coding that made it possible to identify people's email addresses."

After it emerged that Disqus users has been identified in the Expressen news stories, the company was quick to take action.

"Disqus has not been cracked. No emails were leaked by Disqus," vice president for marketing Stephen Roy said in a statement released on Tuesday.

He explained that Disqus offers API services that include "MD5 hashes" of email addresses that allow users to access third-party services such as Gravatar, which in turn permits users to display a consistent avatar across platforms.

"This appears to be a targeted attack on a group of individuals using pattern matching of their activity across the web, associated with email addresses used by those individuals," said Roy, calling the actions a breach of Disqus privacy regulations. "As in all such cases, we are terminating the account."

Roy added that Disqus was disabling use of the Gravatar service and removing the MD5 hash email from its API.

"We will evaluate any further changes that will need to be made based on these actions," he said. Inquiries from The Local for further comment were not immediately returned.

Fredriksson took exception to the Research Group being painted as wrongdoers by Disqus, explaining that he and his time "didn't even use any account for this, and never had to agree on any terms of service"

"We are researchers and they cannot blame us for researching openly available data. I think the bad guys are those who handle our personal information so carelessly," he said.

Fredriksson went on to admit that he and his colleagues aren't sure what to do with the data now in their possession, but expressed fears about who else might have similar technology that could unmask Disqus users.

"You can imagine a lot of unseemly scenarios," he said.  "Perhaps the authorities in Iran, for example, have data like this from Israeli media sites and might use it to find out who is behind the comments."

Fredriksson said the incident is a wake-up call for news sites and online commenters everywhere to be more aware that their data may not be as safe as they had previously thought.

"People need to know more about the risks that arise when third-parties get access to their data," he told The Local. "It shows how much uncertainty there is in systems like this."

David Landes (david.landes@thelocal.se)

Your comments about this article

Today's headlines
Man shot dead at Malmö shopping centre
Mobilia shopping mall on Saturday night. Photo: Johan Nilsson/TT

Man shot dead at Malmö shopping centre

Two hooded gunmen opened fire at a man in a kebab restaurant at one of Malmö’s largest shopping centres on Saturday afternoon, in full view of several families and their children. READ  

Video
Swedes buy Soviet tank for winter fun
Jesper Lysell with his new tank. Photo: Private

Swedes buy Soviet tank for winter fun

You’ve got 100,000 Swedish kronor to blow on something extravagant. Do you buy a low-end sports car? Not if you live in southern Norrland you don’t. You buy a tank. READ  

Sweden braced for fresh barrage of thick snow
A typical drive in Luleå on Friday. Photo: Facebook

Sweden braced for fresh barrage of thick snow

Large swathes of northern and eastern Sweden were preparing for a further dump of snow on Sunday, with the country’s national forecaster warning that some areas could see as much as 30cm. READ  

'The perfect workout': gym clears snow for free
Aerobic snow-shovelling on Saturday morning: Crossfit Holistics webpage

'The perfect workout': gym clears snow for free

A gym in northern Sweden has turned this week’s monster snowfall into “the perfect workout”, sending its members out for an hour on Saturday to shovel snow around the city for free. READ  

Pirate Bay back online seven weeks after raid
The Pirate Bay's homepage on Saturday. Photo: Screen grab

Pirate Bay back online seven weeks after raid

Sweden’s seeming unquashable file-sharing site The Pirate Bay is back online, seven weeks after police seized servers hosted at a data centre in a nuclear-proof bunker deep in a mountain outside Stockholm. READ  

Roma denied sleep complain of 'torture'
The banner erected by the Roma at Sorgenfri Folketshus. Photo: Solidarity with EU migrants

Roma denied sleep complain of 'torture'

A group of Roma immigrants have complained of “torture” and “terrorism” after security guards at a Malmö night café for homeless people refused to let them sleep on the premises. READ  

Israel 'not happy' at Abbas invite to Sweden
US Secretary of State meets Palestinian President Mahmoud Abbas in Amman, Jordan, in November 2014. Photo: Nicholas Kamm/TT

Israel 'not happy' at Abbas invite to Sweden

Israel’s ambassador has sharply criticised Sweden for inviting President Mahmoud Abbas to Stockholm next month, citing it as further evidence of the “energetic pro-Palestinian line” the country’s government has taken since coming to power after September's election. READ  

Beggars 'objectified' at Malmö exhibition
Roma migrants who have swapped the streets for an art gallery. Photo: Albin Balthasar

Beggars 'objectified' at Malmö exhibition

Two Roma beggars have been paid to take part in a controversial art installation that has seen them sitting and standing in silence with a paper cup in front of them in a Malmö art gallery. READ  

More open borders for Swedish nationals
An SAS plane taking off from Sweden. Photo: TT

More open borders for Swedish nationals

From this summer, Swedes may be be able to leave their passports at home when travelling to the UK and other non-Schengen countries within the EU. READ  

Thick snow set to cause further travel chaos
A sign warns about falling snow and ice in Stockholm. Photo: TT

Thick snow set to cause further travel chaos

UPDATED: Heavy snowfall has caused major traffic problems in parts of western and southern Sweden, with further bad weather set to sweep across the country this weekend. READ  

RECEIVE OUR NEWSLETTER AND ALERTS
Lifestyle
What’s on in Sweden this week
Sponsored Article
Stockholm job fair helps immigrant entrepreneurs
Gallery
IN PICTURES: European Figure Skating Championships in Stockholm
National
The return of the Girl with the Dragon Tattoo
Lifestyle
Top five trends from Stockholm Fashion Week
Blog updates

30 January

Editor’s blog, January 30th (The Local Sweden) »

"Greetings from Sweden where much of the country is heading for what could be the coldest..." READ »

 

26 January

The mysterious -s, part 1 (The Swedish Teacher) »

"Hej! How is your Swedish coming along? A while ago I read on a forum on The..." READ »

 
 
 
Gallery
People-watching: January 28th
Business & Money
FATCA: 'The age of financial privacy is over'
National
Does Sweden help returning Isis fighters more than Swedish veterans?
Gallery
IN PICTURES: January snow snaps
Society
Is Sweden's healthcare system a national embarassment?
Gallery
Property of the week: Skanör, Vellinge
Lifestyle
'Life as a Swedish candy-maker is sweet'
National
Why Sweden's Left party wants a European 'Red Spring'
Gallery
IN PICTURES: Sweden's hottest new fashion designers for 2015
Gallery
IN PICTURES: Who travels on Stockholm's different subway lines?
Lifestyle
Why this Swedish baby is a US hit
Lifestyle
'Limousine' snowplough for sale
People-watching: January 24th - 25th
Gallery
People-watching: January 24th - 25th
Society
Meet the 'beggars' buttoning up immigration critics
Gallery
IN PICTURES: Princess Madeleine through the years
Features
Learn Sweden's bizarre dating lingo
People-watching: January 21st - 22nd
Gallery
People-watching: January 21st - 22nd
Society
Why Sweden's viral 'genital' video is getting an English remake
National
Why does Sweden's Luleå have a giant ice beaver?
Gallery
IN PICTURES: Who are Sweden's richest one percent?
Business & Money
How a classic Swedish snack got a revamp for 'busy' Stockholmers
Lifestyle
The Local's top Swedish acts for 2015
Gallery
IN PICTURES: Sweden's Årets Bild photography prize winners
Business & Money
'I met my Swedish man in Tokyo's first Ikea store'
Gallery
Property of the week: A cozy apartment in Bromma, Stockholm
Gallery
People-watching: January 17th - 18th
Lifestyle
How to make Swedish gravad lax
Lifestyle
Four hot Swedish home design trends
National
How The Local's video on a strange Swedish sound went viral
Gallery
People-watching: January 14th
National
The Local's guide to Europe in statistics - from Spain to Sweden
Politics
Paris attacks: Knock-on effects in Sweden and across Europe
National
Swedish Muslims react to new Charlie Hebdo magazine
National
The Local talks to Sweden's Home Affairs Minister about Paris attacks
Business & Money
Will Spotify launch on stock market after users rocket?
Accelerated
Texans and Swedes to play ice instruments
Gallery
Property of the week: An 18th century mansion in Stockholm
Business & Money
'Snowboarding drew me to work in chilly Sweden'
National
Are Sweden's royals moving to London?
Sponsored Article
Everything you need to know about moving to Stockholm
Latest news from The Local in Austria

More news from Austria at thelocal.at

Latest news from The Local in Switzerland

More news from Switzerland at thelocal.ch

Latest news from The Local in Germany

More news from Germany at thelocal.de

Latest news from The Local in Denmark

More news from Denmark at thelocal.dk

Latest news from The Local in Spain

More news from Spain at thelocal.es

Latest news from The Local in France

More news from France at thelocal.fr

Latest news from The Local in Italy

More news from Italy at thelocal.it

Latest news from The Local in Norway

More news from Norway at thelocal.no

950
jobs available
PSD Media
PSD Media is marketing company that offers innovative solutions for online retailers. We provide modern solutions that help increase traffic and raise conversion. Visit our site at:
psdmedia.se
Counselling and Psychotherapy in English
Sometimes living in another culture can cause stress, confusion and feelings of sadness and loneliness. Talking to a professional psychotherapist/counsellor might help you. I am a UKCP Reg. psychotherapist. My practice is in Södermalm, Stockholm.
Contact me to discuss your options