Someone knew how many messages I had, and I asked how.
“I'm a hacker” they replied.
I asked if it was true, and they said no.
Then I asked how they did it, and they wouldn't tell me.
I said I'd report them if they didn't tell me and they haven't replied, so I think they may have been a hacker after all.
I told a member of the Scratch Team (@ceebee) but I haven't reported the user yet, in case they need to do something else and that's why they haven't replied.

UPDATE: That person claims that they ‘used a website’ but when I asked what website they refused to tell me, claiming that the website said they can't link it.
Are they making excuses or telling the truth?

NEW UPDATE: @ceebee got back to me. They say I should change my password and maybe report that user. The person who may have hacked into my account said they would tell me the website. I hope the link's real!

They are lying and tricking the community. You can report them. But please don't share the username.no matter how bad they are, you shouldn't share the name.

But then they said no, so they are fine. Don't report them. And you shouldn't report them for not telling you. That's false reporting and you can get an alert for it.

They knew this by looking at the API, which is public and anyone can see it. They can see anything personal, however, such as what is in the messages. Your info is safe and no one hacked you.

To know how many messages a user has, just use https://api.scratch.mit.edu/users/(USERRNAMEHERE)/messages/count/ . They aren't hacking.

garnet-chan wrote:

To know how many messages a user has, just use https://api.scratch.mit.edu/users/(USERRNAMEHERE)/messages/count/ . They aren't hacking.

Well, if that's the case how come they refused to tell me? I'd tell someone that because I wouldn't want to be false reported!

robinthekitten wrote:

garnet-chan wrote:

To know how many messages a user has, just use https://api.scratch.mit.edu/users/(USERRNAMEHERE)/messages/count/ . They aren't hacking.

Well, if that's the case how come they refused to tell me? I'd tell someone that because I wouldn't want to be false reported!

Whether someone actually breaks into an account or is just making it up, they’re running the risk of being reported either way.
If you are worried that someone can get into your account, you should change your password

robinthekitten wrote:

garnet-chan wrote:

To know how many messages a user has, just use https://api.scratch.mit.edu/users/(USERRNAMEHERE)/messages/count/ . They aren't hacking.

Well, if that's the case how come they refused to tell me? I'd tell someone that because I wouldn't want to be false reported!

Some people like to keep things like this from other people, just to try to assert dominance.
And for the website, I have the link somewhere, let me dig it up…

robinthekitten wrote:

garnet-chan wrote:

To know how many messages a user has, just use https://api.scratch.mit.edu/users/(USERRNAMEHERE)/messages/count/ . They aren't hacking.

Well, if that's the case how come they refused to tell me? I'd tell someone that because I wouldn't want to be false reported!

Pfft, they probably just wanted to keep their “magic trick” to themselves.

They are probably lying. I don't know why, maybe they think they will get popular if they are a “hacker” (sorta like kaj) just change your password.

They are trying to scare you. You can view peoples message count using the API.

Basic88 wrote:

They are trying to scare you. You can view peoples message count using the API.

Someone said that and they said no.

robinthekitten wrote:

Basic88 wrote:

They are trying to scare you. You can view peoples message count using the API.

Someone said that and they said no.

Well then they are lying. There is another website by @world_languages, though I forgot the link to it.

They are not telling the truth - you can use (removed by 4096bits - please do not link to browser extensions) or use the API to access the message count. It's that easy. You can report the user.

The user may also be sarcastic saying that they are a hacker but really they are not. that's why you shouldn't be sarcastic kids

wait did I get ninja'd or did I ninja someone

Basic88 wrote:

robinthekitten wrote:

Basic88 wrote:

They are trying to scare you. You can view peoples message count using the API.

Someone said that and they said no.

Well then they are lying. There is another website by @world_languages, though I forgot the link to it.

i realized i shouldn't link to browser extensions or that kinda stuff

geometric_ghast wrote:

Basic88 wrote:

robinthekitten wrote:

Basic88 wrote:

They are trying to scare you. You can view peoples message count using the API.

Someone said that and they said no.

Well then they are lying. There is another website by @world_languages, though I forgot the link to it.

https://scratchnotifier.cf/

Yes. All they did was go on a third party website or the API.

If they were a real hacker, I don't think they'd be going around saying “I HACKED ____”. They'd get a perma ban pretty quickly. If they were actually a hacker, they would keep quiet, stay in the shadows. They are most likely a attention seeking little kid

They probably used one of the websites that other people mentioned. If you're still worried you should reset your password.

It’s most likely that they used the API. Still, report the comment(s) and just to be safe, change your password.

robinthekitten wrote:

garnet-chan wrote:

To know how many messages a user has, just use https://api.scratch.mit.edu/users/(USERRNAMEHERE)/messages/count/ . They aren't hacking.

Well, if that's the case how come they refused to tell me? I'd tell someone that because I wouldn't want to be false reported!

Maybe they just wanted to keep it to themselves. I would also do that

If the person really was able to enter your account, you would not be able to login ever again and/or the account would be deleted.

You do not need email confirmation or anything to change a Scratch account's password to something different. It does send you an email, but if you are logged into a Scratch account you can also see right there what the email is, and if they used the same password for both email and Scratch account, they can simply delete it plus something a billion times more harmful.

If someone hacked your account, they most likely would not say so on your profile. It is easy to see how many messages anyone has. They were trying to trick you. If you see anything like that, report the comment.