buset dah gw tinggal tidur tadi siang rame disebelah masalah securitylagi.

If you connected your email it is publically visible to everyone

If you connected your email it is publically visible to everyone

You may remember this Thread:
If you linked via mobile, your phone numbers are publically visible to everyone

Well I found out that the same thing is possible with E-Mails now but in a slightly different way.
This "exploit" probably exist since the game does and I wonder how no one reported it yet.

Who is affected: Literally everyone who linked his Email to his Mihoyo Account - No joke!

Sure leaked Emails aren't as bad as leaked phone numbers but this time all accounts are affected.
And there is a reason why Mihoyo actually censors them right..

If you click "Having Problems?" at Mihoyos Login which is basically the "Forgot Password" thing it will ask you to enter a Username or Email. If for example you are very active at Mihoyos Forum and someone, maybe a Hacker, wants to know your Email, all he has to do is enter your Username into the Forgot Password Field. Yes that Email will be censored.. BUT..

However using the inbuild Developer Tool which every single Browser has and which is accessible to everyone you are able to see the full uncensored Email if you have a bit of knowledge.

And with "a bit of knowledge" I don't mean "experience that you gain within 2 years" but "experience that you get through 5 minutes of googling how it works".

Well Mihoyo.. when did you want to add 2FA again?

One more time.. having private information exposed this easily on the internet isn't ok.

Proof:



EDIT: This exploit has been fixed now (8 hours after I posted this thread at 14:00 UTC +1).

It's concerning that Mihoyo doesn't notice such simple and obvious mistakes on their own and we have to start a big drama first until they do something about it.

But even worse is that Mihoyo doesn't and probably never will inform anybody about those security leaks and most likely won't post an announcement or an apology about it like it is the case with the leaked mobile number issue. To see them silently fixing exploits without learning from their mistakes and improving their security at all as well as simply adding 2FA is incomprehensible to me.

Since new leaks and exploits for Mihoyo are found almost weekly, everyone should be aware already that their data is not safe at Mihoyo. At this Point I would advise everyone to create a completely new email, buy a prepaid number and connect your account only with information that is not important to you because if such a mistake is possible I am sure there will be much more to come.

Many thanks to everyone who helped to make Mihoyo aware of this problem.

Edit 2: As I wrote Mihoyos Support about the Issue also asking about 2FA I got this reply:



Funny how they write that "The issue is long fixed" which has been fixed just a few hours ago.
If this Thread didn't exist that "long fixed" issue would still exist tho so nice one Mihoyo..

-------------

berarti kasus orang2 yg active diforum (same username) mihoyo bisa kena hack gara2 security ini lemah lagi



edit : update komeng OP.

edit #2 : ss & komeng OP.