Have I Been Pwned? Data breach master list with API

Re:Have I Been Pwned? Data breach master list with API by logicallee on Monday March 14, 2016 @08:32PM (#11286659)

Yes, I'm serious. I don't only use mailinator: some sites blacklist mailinator and somehow blacklist its alises (I know devnullmail off the top of my head, to name one of its aliases). For this reason I also have a gmail account dedicated to spam. I just checked for you, and have received 6 pieces of mail to it in the past three day, to the inbox (not filtered as spam). But hey, you go ahead and continue to rely on the fact that spammers will never ever figure out how to apply a s/\+(.+)@gmail.com/@gmail.com/g to a list of email addresses (since I and most people use gmail.com and not some other domain).

I don't know how much spam my mailinator accounts get, since I don't check them. But let's check [email protected] since I bet someone has picked that name. In the past hour this is the spam it got:

http://imgur.com/PS7O3Ov

That's 9 pieces of spam in 2 hours. You think Dr Dave, who personally addresses someone who signed up somewhere as (throwaway) in his subject line, is above applying a regex? Do you think the person who sent out "1 Sl!tty Friend Alert" is above applying that regex? You think that Kaylyn, who sent out "Two cute ebony teens in threesome" is above applying that regex?

That's nice. That's the definition of security by obscurity. Literally the definition. So, yes, I'm serious.

[ Parent | on HN ]

Re:Have I Been Pwned? Data breach master list with API by untog on Monday March 14, 2016 @11:03PM (#11287177)

But that spam would never appear in your Gmail inbox. Google decided (rightly, IMO) that it would be a better use of time to filter spam than provide email aliases.

[ Parent | on HN ]

Re:Have I Been Pwned? Data breach master list with API by logicallee on Tuesday March 15, 2016 @01:41PM (#11291466)

Of course it should appear in my Gmail inbox: I actively give out the email and thereby expect that my recipient can send me mail whatever they want. If I give Bob's Spam Emporium the email address "[email protected]" which means "[email protected]" then that means I've given Bob the means to email me whatever they want. You literally give someone permission to email you when you give them an email address, it's pretty much the definition of giving out an email address.

If Bob starts going overboard on emailing [email protected] that doesn't mean I don't still want to see all that crap. Maybe I really care about what Bob has to say.

Or maybe he's selling email address to sweepstakes companies, Nigerian princes, investment opportunities, fake legal notices, and so forth.

It's nice of Google to try to decide these things and help me classify my mail. But ultimately providing email aliases is an important step.

They have all of the comment functionality in place ([email protected] goes to [email protected] with the label comment) and now just need to be able to give me an alias for "me+comment" so that I can give that out instead of my valuable string "me", which I don't want to give spammers.

It's not really rocket science. They're 99.99% of the way there.

I hope sooner or later some luminary will take that final 0.01% and let me stop using mailinator for registrations that I expect have a high chance of spamming me in the future. :)

I'd like to be able to trust Bob's Spam Emporium first, have it really go to my inbox, and only redirect squirehamboard (i.e. [email protected]) if I ever read an email that I shouldn't have gotten to it. (Since it'll be labelled bobspam it'll be easy for me to decide if I want to nuke it all or just redirect it.)

Gmail's spam filtering is pretty good. Ultimately, part of what makes it good though is that I don't give my gmail address out to spammy sites at all.

I bet I'd get a lot more spam if I didn't use mailinator as well...

[ Parent | on HN ]

Re:Have I Been Pwned? Data breach master list with API by DigitalJack on Tuesday March 15, 2016 @01:58PM (#11291631)

I guess I'm just confused by your use of the term security. Accounts aren't being compromised.

I use a specific Gmail address for sign-ups. Sometimes I use the plus sign as a tag, but if someone chops it off, I don't really care. It's just a piece of disinformation that might let me know who leaked an email address.

[ Parent | on HN ]

Re:Have I Been Pwned? Data breach master list with API by logicallee on Tuesday March 15, 2016 @04:42PM (#11292819)

I can explain if you want to (ironically) list some way for me to contact you - I'm not participating in this thread anymore. (Obviously I'll treat the address with respect, I don't mean that I plan to demonstrate it dramatically, I'm just tired of the downvotes.)

[ Parent | on HN ]