• Sweden's news in English
 

Swedes uncover Disqus user security breach

David Landes · 12 Dec 2013, 15:15

Published: 12 Dec 2013 15:15 GMT+01:00

After outing several 'online haters' at home, which caused several resignations from the populist, far-right Sweden Democrat party, the Swedish investigative journalists behind the revelations said they had accessed the identities of several million commenters using the popular Disqus system.

Martin Fredriksson and his colleagues started collecting Disqus data back in February 2013 as part of a project to more closely analyze anonymous online comments. They hoped to understand more about who was behind hateful and racist comments on far-right websites in Sweden. They unearthed some 6,000 anonymous accounts in Sweden on commission from the tabloid Expressen, which published the data on Tuesday.

Fredriksson told The Local on Thursday that the unmasking of a few thousand users behind pseudonyms used on far-right sites in Sweden could just be the tip of the iceberg.

There were millions of Disqus users whose identity is at risk of exposure, said Fredriksson, responsible publisher (ansvarig utgivare) for the Research Group (Researchgruppen, who said his group's database contained a total of 29 million comments from Disqus users around the world.

"We used an open Disqus API protocol to obtain the data," he said, using a common acronym for "application protocol interface", which specifies how software components should interact with one another. In order to obtain the data more efficiently, Fredriksson wrote a programme that automated the data download requests sent to Disqus servers.

"You usually get around 100 comments with one request, but our system was able to send ten requests at once," he explained.

While the thrust of the research focused on far-right sites in Sweden, data was also collected from news sites elsewhere in the world, including CNN, The Telegraph, ABC News, and The Jerusalem Post, as well as from mainstream Swedish news site such as Svenska Dagbladet, SVT Debatt as well as The Local.

Members of the Research Group quickly realized, however, that the data they received also came with metadata that included the email addresses tied to anonymous Disqus accounts.

"It came as something as a shock," he said. "We got a lot of data we probably weren't supposed to get."

Fredriksson emphasized that the group didn't use any illicit methods in obtaining the data, but that the information was included in their trawl due to a security flaw at Disqus.

"When you leave a comment as a Disqus user, there is information about the date, username, and the comment itself which is open data," he said. "But (Disqus) also sent us data with coding that made it possible to identify people's email addresses."

After it emerged that Disqus users has been identified in the Expressen news stories, the company was quick to take action.

"Disqus has not been cracked. No emails were leaked by Disqus," vice president for marketing Stephen Roy said in a statement released on Tuesday.

He explained that Disqus offers API services that include "MD5 hashes" of email addresses that allow users to access third-party services such as Gravatar, which in turn permits users to display a consistent avatar across platforms.

"This appears to be a targeted attack on a group of individuals using pattern matching of their activity across the web, associated with email addresses used by those individuals," said Roy, calling the actions a breach of Disqus privacy regulations. "As in all such cases, we are terminating the account."

Roy added that Disqus was disabling use of the Gravatar service and removing the MD5 hash email from its API.

"We will evaluate any further changes that will need to be made based on these actions," he said. Inquiries from The Local for further comment were not immediately returned.

Fredriksson took exception to the Research Group being painted as wrongdoers by Disqus, explaining that he and his time "didn't even use any account for this, and never had to agree on any terms of service"

"We are researchers and they cannot blame us for researching openly available data. I think the bad guys are those who handle our personal information so carelessly," he said.

Fredriksson went on to admit that he and his colleagues aren't sure what to do with the data now in their possession, but expressed fears about who else might have similar technology that could unmask Disqus users.

"You can imagine a lot of unseemly scenarios," he said.  "Perhaps the authorities in Iran, for example, have data like this from Israeli media sites and might use it to find out who is behind the comments."

Fredriksson said the incident is a wake-up call for news sites and online commenters everywhere to be more aware that their data may not be as safe as they had previously thought.

"People need to know more about the risks that arise when third-parties get access to their data," he told The Local. "It shows how much uncertainty there is in systems like this."

David Landes (david.landes@thelocal.se)

Your comments about this article

Today's headlines
One dead after shooting and stabbing in Rinkeby
Police examining the murder scene in Rinkeby. Photo: Johan Nilsson/TT

One dead after shooting and stabbing in Rinkeby

3 hours ago

One person has been killed and three others injured in a shooting and stabbing incident in the Rinkeby suburb of Stockholm.

Swedish police: ‘Help us find kidnapped man’
Anton was abducted in a red VW Passat. Photo of car (not involved in incident): Praiselightmedia, via Wikimedia

Swedish police: ‘Help us find kidnapped man’

5 hours ago

A 27-year-old man was beaten and abducted by several people in a red VW Passat earlier this week in Gothenburg.

Sweden Democrats: 'We will run the country'
Jimmie Åkesson, the leader of the Sweden Democrats, speaking on Saturday. Photo: Rickard Nilsson/TT

Sweden Democrats: 'We will run the country'

1 day ago

In his keynote summer speech on Saturday in his hometown of Sölvesborg, Jimmie Åkesson, the leader of the far-right Sweden Democrats, predicted that his party would one day be strong enough to run the country and called for a referendum on immigration.

Plane crash-lands on Swedish road
Photo: Adam Ihse

Plane crash-lands on Swedish road

1 day ago

A light aircraft was forced to land on Highway 27 outside Borås at lunchtime. No one was harmed.

The Local investigates
Should more people live on boats in Stockholm?
House boats at Pampas Marina. Photo: Janerik Henriksson/TT

Should more people live on boats in Stockholm?

1 day ago

Living on a boat in Stockholm used to be the preserve of the rich. But as the city's housing crisis swells, could more affordable floating accommodation help provide a solution to the shortage? The Local investigates.

Julian Assange
Sweden and Ecuador set to launch Assange talks
WikiLeaks founder Julian Assange. Photo: AP Photo/Kirsty Wigglesworth

Sweden and Ecuador set to launch Assange talks

2 days ago

Sweden is seeking to reach a deal to pave the way for prosecutors to question Julian Assange at the Ecuadorian embassy in London where the Wikileaks founder has been holed up for over three years as he fights an extradition to Sweden over rape allegations.

Stockholm bin men rescue doomed kitten
'It trembled like a leaf'. Photo: Bekir Mercil/Private

Stockholm bin men rescue doomed kitten

2 days ago

Stockholm waste collector Bekir Mercil and his two colleagues were on Friday hailed heroes of the day after they saved a terrified kitten who had fallen into a garbage truck, stuck in tonnes of food waste headed for the incinerator.

Trio in court over attack on Swedish serial rapist
Umeå held a demonstration against sexual violence toward women when Lindgren was released in July. Photo: John Gunseum/TT

Trio in court over attack on Swedish serial rapist

2 days ago

UPDATED: Three men have been remanded in custody over a weekend golf club attack on one of Sweden's most notorious serial rapists who was released from prison earlier this month.

Swedes debate capital's first Airbnb rent ‘ban’
The apartment is located in Stockholm's trendy Södermalm neighbourhood. Photo: Christine Olsson/TT

Swedes debate capital's first Airbnb rent ‘ban’

3 days ago

UPDATED: A landmark ruling banning a woman in Stockholm from renting out her apartment via the home-sharing website Airbnb after a rent tribunal likened the letting with running a "hotel business" on the premises has sparked debate in Sweden.

Text messages to warn Swedes of terror attacks
Swedish Interior Minister Anders Ygeman. Photo: Bertil Ericson/TT

Text messages to warn Swedes of terror attacks

2 days ago

The Swedish government wants to step up its fight against terror with a new strategy that includes warning civilians to stay away from certain geographical areas via text message.

RECEIVE OUR NEWSLETTER AND ALERTS

National
This Swedish teen was told she was 'too big' to be a model
Lifestyle
Six reasons to stay outdoors this week
Gallery
People-watching: August 26th
Sponsored Article
Nine places where Stockholm needs more English
National
Rescued baby lemur gets new Stockholm home
Blog updates

28 August

Editor’s blog, August 28th (The Local Sweden) »

"Hello readers, It was all glitz and glamour in Sweden this week as Stockholm Fashion Week got..." READ »

 

18 August

Preteritum eller presens perfekt? (The Swedish Teacher) »

"Hello everyone, It’s grammar time ! I got an interesting question about the past tense vs present..." READ »

 
 
 
National
Stockholm Fashion Week turns island into Mars
Sponsored Article
'It gives you the guts to believe in yourself'
Gallery
Property of the week: Stora Essingen, Stockholm
National
Swedish crayfish thieves caught red handed by officers
National
Veil soon to be lifted on new Millennium sequel novel
Gallery
People-watching: August 21st - 22nd
Cecilia Larsson Lantz/imagebank.sweden.se
Presented by Stockholm Academic Forum
International students welcomed to Stockholm
National
The Bridge: What does the third season have in store?
National
Lucky escape for Swedes after 'dead' bear launches attack
National
Syrian asylum seeker comic: 'We don't prefer Sweden any more'
National
Are anti-immigration nationalists really now Sweden's biggest party?
Lifestyle
Baby joy for Swedish crime queen and her wrestler boyfriend
National
Soldier accused of faking first Isis attack in Sweden
National
Fire alert as Sweden sizzles in summer heatwave
Gallery
People-watching: August 19th
National
Meet the Swede who is crazy for Norway’s mass killer
National
Swede's review of night in drunk tank goes viral
National
VIDEO: Swedish teen melts hearts with this incredible Idol audition
Society
What's a Swedish crayfish party?
National
UN: Sweden can't be left to shoulder migrant crisis alone
Gallery
Property of the week: Skogås, Huddinge
National
Men outstrip women for first time
Society
IN PICTURES: Wooden town resembles 'war zone' after huge fire
Gallery
People-watching: August 14th-16th
Sport
Swedish referee shuts viral Facebook page explaining his decisions
Business & Money
A studio in Stockholm or a castle in the countryside?
National
How did twelve skeletons end up beneath a Swedish castle?
Pharmacy to launch plasters for darker skin in anti racism drive
Gallery
People-watching: August 12th
National
TIMELINE: Everything you need to know about the Julian Assange case
National
Millennium sequel author labelled 'grave robber'
National
Two metre long python stops traffic in Malmö
National
IN PICTURES: Shoppers pay tribute to Ikea stabbing victims
Technology
Danish 'monster' pulled out of Swedish waters
National
Bizarre baby baptism for hockey fan
Gallery
Property of the week: Löderup, Ystad
National
Sunshine brightens up Sweden
Gallery
People-watching: August 7th-9th
National
Shocking video sheds light on Swedish 'anti-gay discrimination'
Sponsored Article
Getting pregnant the Swedish way
Sponsored Article
Outsourcing drives Apreel's Europe growth
Latest news from The Local in Austria

More news from Austria at thelocal.at

Latest news from The Local in Switzerland

More news from Switzerland at thelocal.ch

Latest news from The Local in Germany

More news from Germany at thelocal.de

Latest news from The Local in Denmark

More news from Denmark at thelocal.dk

Latest news from The Local in Spain

More news from Spain at thelocal.es

Latest news from The Local in France

More news from France at thelocal.fr

Latest news from The Local in Italy

More news from Italy at thelocal.it

Latest news from The Local in Norway

More news from Norway at thelocal.no

3,215
jobs available
PSD Media
PSD Media is marketing company that offers innovative solutions for online retailers. We provide modern solutions that help increase traffic and raise conversion. Visit our site at:
psdmedia.se