Amazon's customer service backdoor

Re:Amazon's customer service backdoor by JoshTriplett on Sunday January 24, 2016 @06:13PM (#10964507)

Note, though, that catch-all emails will also catch a ridiculous amount of spam. Creating each account name individually avoids that problem, at the cost of some extra trouble when registering a new service.

An intermediate step that may work if you don't expect people to target you individually: have one or more required substrings for the email local part, and catch all mail to addresses containing that substring.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by _ikke_ on Sunday January 24, 2016 @06:19PM (#10964529)

I created my catch-all on a subdomain. While it gives a problem with certain websites (don't consider it a valid e-mail address), I barely receive spam on it.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by belovedeagle on Sunday January 24, 2016 @09:42PM (#10965278)

> While it gives a problem with certain websites (don't consider it a valid e-mail address)

Are you saying that there are sites out there which don't accept [email protected] a valid email address? If so, that's beyond broken...

[ Parent | on HN ]

Re:Amazon's customer service backdoor by steve-howard on Sunday January 24, 2016 @10:02PM (#10965329)

My school's student addresses ended in @u.northwestern.edu. You can imagine this was annoying sometimes when email addresses ending in .edu were used to verify student status.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by mappu on Monday January 25, 2016 @01:46AM (#10965953)

>My school's student addresses ended in @u.northwestern.edu. You can imagine this was annoying sometimes when email addresses ending in .edu were used to verify student status.

Sorry, could you repeat that? [email protected] certainly matches \.edu$.

Unless you're worried about the false-positive for a non-student with a different subdomain?

[ Parent | on HN ]

Re:Amazon's customer service backdoor by thecopy on Monday January 25, 2016 @05:09AM (#10966401)

It doesnt match \w\.edu$

[ Parent | on HN ]

Re:Amazon's customer service backdoor by kuschku on Monday January 25, 2016 @05:22AM (#10966433)

And you can imagine how maddening it is when 90% of students worldwide don't have a .edu, but some do.

Only one university in Germany has a .edu, and their students obviously manage to get far more benefits than those of us with an @informatik.uni-kiel.de email.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by pcora on Monday January 25, 2016 @08:04AM (#10966920)

99% of times we need to send proof that we are students, what is interesting is that many companies accept that even if it's not in English. Probably on good faith.

In Brazil, universities can use .edu.br, but we have few universities providing email addresses to students and also, the majority of grad schools in Brazil are not universities but a small college called 'University Center'

[ Parent | on HN ]

Re:Amazon's customer service backdoor by pyre on Sunday January 24, 2016 @06:45PM (#10964629)

One method that I've seen used (heard it described by a guest one of Leo Laporte's podcasts a looooong time ago) is to iterate account names by year. For example, this year the email address would be [email protected], and next year it will be [email protected]. Not sure how well it works, but the idea is that by that every year you start over with a fresh address (that takes a while to get onto spam lists).

I'll note that I don't use this method as it seems too high maintenance and the effectiveness is unclear.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by jethro_tell on Monday January 25, 2016 @01:48AM (#10965959)

I believe the real issue here is its not uncommon for spam services to try to locate valid email addresses. Generally, an email server won't accept email to an invalid users and will probably start flagging the incoming server/domain as those attempts start to cross a threshold of some sort. OP is talking about *@example.com as a catchall which means a spammers script will sit there and email a dictionary of usernames against your domain until it crosses it's own threshold. It's not too hard to add an alias for each name as you go along but it really depends whose list your domain gets on.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by pyre on Tuesday January 26, 2016 @12:07AM (#10971909)

I was talking about making those actual accounts vs. aliases to the catchall address. That method makes no sense if each pyre<year>@example.com email address was just an alias to the catchall because pyre<previous_year>@example.com would still be caught by the catch-all, even if you disabled the alias.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by newman314 on Sunday January 24, 2016 @07:12PM (#10964739)

Not a big deal if using a password manager and email acts as username.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by pyre on Tuesday January 26, 2016 @12:08AM (#10971914)

Using it as your mail email for personal/business purposes could run you into trouble though. Most people aren't used to a rotating email address.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by pavel_lishin on Sunday January 24, 2016 @11:24PM (#10965550)

> Note, though, that catch-all emails will also catch a ridiculous amount of spam

Hasn't been a problem for me.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by morgante on Sunday January 24, 2016 @07:07PM (#10964710)

> Note, though, that catch-all emails will also catch a ridiculous amount of spam.

I haven't found this to be true, or at least Google's spam filters have gotten sufficiently good to prevent it.

I have a catch-all address @morgante.net and rarely ever see spam—maybe once a week.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by jakobegger on Sunday January 24, 2016 @06:44PM (#10964622)

I receive all mails @ my domain and I get about 1 spam a day. Fastmail's spam filters are pretty good.

[ Parent | on HN ]

Re:Amazon's customer service backdoor by bigiain on Sunday January 24, 2016 @06:54PM (#10964662)

Do you have a good idea of the rate of false positives?

[ Parent | on HN ]

Re:Amazon's customer service backdoor by jakobegger on Wednesday January 27, 2016 @02:28PM (#10982378)

No, I don't check my spam folder. Never had any reason to do so in the last couple of years.

[ Parent | on HN ]