Episode
30 March 2021 Official episode · Official transcript
research
The episode features Victor, a prolific responsible-disclosure researcher, and discusses his vulnerability-reporting organisations, internet-wide scanning practices, and his 2020 discovery that Donald Trump’s Twitter account lacked two-factor authentication and could be accessed using a guessed password.
Topics: Responsible and coordinated vulnerability disclosure, Internet-wide vulnerability scanning, Exposed databases and weak or default credentials, Two-factor authentication for high-profile accounts, Password reuse and password guessing, Ethical boundaries of unsolicited security testing, Unauthorized access and responsible-disclosure legal exceptions, Security reporting and remediation coordination
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Victor MEMBER_OF Guild of the Grumpy Old Hackers
Victor is identified as a member of the Guild of the Grumpy Old Hackers.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“Victor in this episode who’s part of the Guild of the Grumpy Old Hackers.”
Victor USES responsible disclosure
Victor has made a long-term practice of filing responsible disclosures.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“he’s made a life out of filing coordinated vulnerability disclosures”
Victor USES Internet-wide vulnerability scanning
Victor constantly scans the internet for vulnerabilities.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“Victor is constantly scanning around, looking for vulnerabilities and reporting them.”
Victor USES UNIX terminal
Victor used the store computer's UNIX terminal to escape to a shell.
Explicit Confidence 98% · Victor EP 88 Details
“That terminal, that was just a UNIX terminal”
Victor MEMBER_OF Dutch government
Victor obtained a job with the Dutch government and later described it as his employer.
Explicit Confidence 96% · Jack Rhysider EP 88 Details
“got a job with the Dutch government”
GDI Foundation DEVELOPED_BY Victor
Victor and a friend started the GDI Foundation in 2016.
Explicit Confidence 98% · Jack Rhysider EP 88 Details
“him and a friend started a non-profit that was all about finding and reporting vulnerabilities. They called it the GDI Foundation”
Victor MEMBER_OF GDI Foundation
Victor is one of the people who started and worked for the GDI Foundation.
Derived Confidence 88% · Jack Rhysider EP 88 Details
“Victor and his friends went all-in that year.”
GDI Foundation USES Coordinated vulnerability disclosure
The GDI Foundation filed coordinated vulnerability disclosures on security issues.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“the foundation has filed coordinated vulnerability disclosures on over a million security issues”
GDI Foundation USES Internet-wide vulnerability scanning
GDI continuously checks internet-exposed databases to identify whether they have been patched or compromised.
Derived Confidence 94% · Jack Rhysider EP 88 Details
“GDI adds the database to a script that’s constantly running. It checks up on the database every so often”
GDI Foundation USES default credentials
GDI's vulnerability work included finding internet-exposed databases with default credentials.
Explicit Confidence 96% · Jack Rhysider EP 88 Details
“databases just left open with default credentials”
Victor used Shodan to find IPs with MySQL's port open while looking for exposed databases.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“he could just scan the internet or use a website like Shodan”
Victor USES default credentials
Victor tried default usernames and passwords when checking exposed databases.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“he’ll try default usernames and passwords”
Victor MEMBER_OF Dutch Institute for Vulnerability Disclosure
Victor is the chairman of DIVD.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“Victor’s the chairman.”
Dutch Institute for Vulnerability Disclosure USES Internet-wide vulnerability scanning
DIVD often scans computers in the Netherlands for vulnerabilities.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“they often scan computers in the Netherlands for vulnerabilities”
Dutch Institute for Vulnerability Disclosure ASSOCIATED_WITH GDI Foundation
DIVD is described as being similar to GDI, though it is run by Dutch researchers.
Explicit Confidence 97% · Jack Rhysider EP 88 Details
“DIVD is a lot like GDI but it’s ran by Dutch researchers”
2020 Trump Twitter account access ATTRIBUTED_TO Victor
The 2020 Twitter account access incident is presented as Victor's coordinated disclosure and account access.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“Victor hacked Trump a second time.”
2020 Trump Twitter account access COMPROMISES Twitter
Victor gained access to Donald Trump's Twitter account during the 2020 incident.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“Trump’s Twitter account loaded up on Victor’s screen.”
2020 Trump Twitter account access INVOLVES Donald Trump
The incident involved Donald Trump's personal Twitter account.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“Donald Trump’s personal Twitter account didn’t have two-factor authentication turned on in 2020”
2020 Trump Twitter account access INVOLVES Two-factor authentication
The incident centered on two-factor authentication being disabled on Trump's account.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“two-factor authentication was definitely turned off on @realDonaldTrump’s account”
2020 Trump Twitter account access INVOLVES password reuse
Victor suspected that Trump's Twitter password might reuse or resemble a password used by Trump's campaign, and tried variants of the rally Wi-Fi password; this is presented as a possibility rather than a confirmed practice.
Uncertain Confidence 91% · Jack Rhysider EP 88 Details
“they might reuse some or maybe they’d use slightly different versions of the same password”
2020 Trump Twitter account access INVOLVES Unauthorized access
The incident involved gaining unauthorized access to another person's account, which the Dutch prosecutor said was normally illegal.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“gaining unauthorized access to someone else’s account is illegal in the Netherlands”
2020 Trump Twitter account access INVOLVES Coordinated vulnerability disclosure
Victor treated the account access as a coordinated vulnerability disclosure and forwarded the disclosure to the Secret Service.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“Victor forwarded his coordinated disclosure to the Secret Service.”
2020 Trump Twitter account access INVOLVES United States Secret Service
The Secret Service contacted Victor and investigated the disclosure.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“someone, from the Secret Service reaching out to Victor”
2020 Trump Twitter account access INVOLVES Dutch High-Tech Crimes Unit
The Dutch High-Tech Crimes Unit investigated how Victor accessed the account and handled the disclosure.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“When the Dutch High-Tech Crimes Unit came knocking”
2020 Trump Twitter account access INVOLVES Dutch government
The Dutch government investigated Victor's claims after US authorities requested an investigation.
Explicit Confidence 98% · Jack Rhysider EP 88 Details
“US authorities reached out to the Dutch government and asked someone to take a look into Victor’s claims”
2016 Trump Twitter account access ATTRIBUTED_TO Victor
Jack states that Victor had accessed Trump's account in 2016 and submitted a responsible disclosure about it.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“Victor had hacked Trumps account back in 2016”
2016 Trump Twitter account access COMPROMISES Twitter
The 2016 incident involved access to Trump's Twitter account.
Derived Confidence 93% · Jack Rhysider EP 88 Details
“we submitted a responsible disclosure to Trump four years ago explaining this exact problem”
2016 Trump Twitter account access INVOLVES Donald Trump
The 2016 incident concerned Donald Trump's Twitter account.
Explicit Confidence 99% · Jack Rhysider EP 88 Details
“this whole thing with Trump’s Twitter in 2016”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:57:24.448177+00:00