DocuSign email address database breached and used for phishing campaign

Re:DocuSign email address database breached and used for phi... by jawns on Tuesday May 16, 2017 @08:19AM (#14348958)

The way I get around that is by having a static keyword that must also appear on the user side of the email address.

So, if I'm dealing with Walmart, I would give them:

walmart.[keyword]@example.com

Then I configure my catch-all settings to reject any email addresses that don't have that keyword.

Of course, the keyword is not secret, so it's possible for someone to infer what I'm doing and construct an email address that passes my spam check, but in practice, nobody goes through the trouble, because I'm not a big enough target.

[ Parent | on HN ]

Re:DocuSign email address database breached and used for phi... by wiredfool on Tuesday May 16, 2017 @08:36AM (#14349047)

Yeah, I wound up using name-tag@domain, but because I used a dash rather than plus, I'm forever doomed to run my own mailserver.

(fwiw, this domain is almost 20 years old, so that's forever in internet years)

[ Parent | on HN ]

Re:DocuSign email address database breached and used for phi... by lorenzhs on Tuesday May 16, 2017 @10:35AM (#14349869)

I use my domain with FastMail, they support aliases and catch-all and lots of other nice things on custom domains. They also do DKIM, SPF, etc. So you don't have to run your own mail server if you don't want to ;)

https://www.fastmail.com/help/receive/domains.html

https://www.fastmail.com/help/receive/domains-setup-mxonly.h...

https://www.fastmail.com/help/receive/alias-catchall.html

https://www.fastmail.com/help/receive/addressing.html

https://www.fastmail.com/help/receive/domains-advanced.html

[ Parent | on HN ]

Re:DocuSign email address database breached and used for phi... by wiredfool on Tuesday May 16, 2017 @12:36PM (#14350918)

Fastmail uses a +, I use a -. So, either I'd have to go in and alias all of them, or give up on the useful ones.

Besides, there are 30 or so that I have black holes, from back when comment systems leaked email addresses.

[ Parent | on HN ]

Re:DocuSign email address database breached and used for phi... by pavel_lishin on Tuesday May 16, 2017 @11:58AM (#14350582)

Sounds vaguely like the way email addresses work in Ender's Game - typically, all mail would go to user%SECRET@server, and if you don't know SECRET, the email presumably bounces.

[ Parent | on HN ]