News for hackers. Stuff that matters.

A comment on Ancestry.com can use your DNA to target ads. Parent comment

Re:Ancestry.com can use your DNA to target ads by throwaway4567 on Monday September 07, 2015 @05:52PM (#10183222)
> Even the header would probably be enough in this case, just to identify the particular masked email with the real email behind it.

Are you implying that an HTTP header sent in the request to 23andme upon clicking the confirmation link would contain the forwarded email address of the user?

Unless the user were on a web page that included their email account name in the URL (and thus visible in the REFERER header), I don't see how that would happen. And I don't think I've ever seen an email system that puts the account name in the URL.

[ Parent | on HN ]
Re:Ancestry.com can use your DNA to target ads by ikeboy on Monday September 07, 2015 @06:03PM (#10183265)
No, the email header sent by abine when they forward the email from 23andme. That contains their real email address in plaintext, and might also contain the masked address; if not, a timing attack given the time of 23's emails and the time of the forwarded email might work.

If the actual email is unencrypted, then the NSA gets everything for free.

[ Parent | on HN ]