Privacy and trust leaks: Meta's Muse and a ransom negotiator turned extortionist
Meta's Muse exposed users' personal and business secrets when they shared conversations. The root cause, per a commenter, is that subdomain names can be queried through passive DNS records, so putting supposedly unguessable identifiers in subdomains leaks them. Reactions ranged from sarcasm about Meta and privacy to blunt victim-blaming.
Separately, feds suspect a ransom negotiator ran the ShinyHunters extortion site. Incident response people in the thread say most negotiators are professional and extremely valuable. Another noted that ShinyHunters also hit the FBI recruitment site fbijobs.gov, and that incompetence has persisted since the OPM breach 11 years ago.
The pattern: the weakest point is usually the share link or the trusted intermediary, not the core system. A share feature is a public-by-obscurity feature unless proven otherwise.
So what?
Audit every share-link and public-URL feature. Unguessable tokens belong in the path with real access controls, never in hostnames that DNS logs expose. Vet any third parties you bring into a breach response, because they hold the most sensitive moment of your company's life.