DocuSign email address database breached and used for phishing campaign

Re:DocuSign email address database breached and used for phi... by Avalyst on Tuesday May 16, 2017 @03:46AM (#14348012)

I do the same with Gmail, just add + at the end (As in [email protected]). Of course this has the drawback of some sites being to restrictive with their checks for valid emails and not allowing the + character

[ Parent | on HN ]

Re:DocuSign email address database breached and used for phi... by corobo on Tuesday May 16, 2017 @04:03AM (#14348068)

If I were a spammer I'd loop through my email address list and strip out + and anything between it and @

[ Parent | on HN ]

Re:DocuSign email address database breached and used for phi... by darkhorn on Tuesday May 16, 2017 @05:45AM (#14348433)

Actually most of the web sites do not accept the + character.

[ Parent | on HN ]

Re:DocuSign email address database breached and used for phi... by Avalyst on Tuesday May 16, 2017 @10:28AM (#14349819)

Actually my experience is the opposite :)

[ Parent | on HN ]

Re:DocuSign email address database breached and used for phi... by Xylakant on Tuesday May 16, 2017 @04:00AM (#14348058)

The other disadvantage is that it's trivial to infer the true username from that pattern in an automated fashion.

[ Parent | on HN ]

Re:DocuSign email address database breached and used for phi... by Avalyst on Tuesday May 16, 2017 @10:29AM (#14349828)

Yep, it's not foolproof but it's better than nothing. And considering that the number of people using it aren't that many (I guess) spammers wouldn't bother

[ Parent | on HN ]