This demonstrates why forcing people to use E-mail addresses as user IDs is a stupid, stupid policy.
Usernames are almost always quasi public knowledge, even when they're not email addresses. The problem here was the existence of a default password, not the fact that you could figure out usernames.
alt Hacker News
Usernames are almost always quasi public knowledge, even when they're not email addresses. The problem here was the existence of a default password, not the fact that you could figure out usernames.