Hacking law firms with abandoned domain names

Re:Hacking law firms with abandoned domain names by r3bl on Monday August 27, 2018 @06:33AM (#17850563)

Something that came into my mind after reading this:

Let's say your name is Jon Doe and you've purchased domain.tld that was previously-used by some company. So you create to yourself [email protected], and figure out that the previous owner had an employee named Jon that used it as a primary or secondary email across dozens of most popular services.

How the hell do you proceed with your account creation?

The entirety of the web is built on the notion that email addresses are unique, but there are multiple cases in which that might not be the case. What are your options then? [email protected]?

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by Jedi72 on Monday August 27, 2018 @07:27AM (#17850740)

Hotmail addresses used to expire after a period of inactivity lol. I pranked one of my high-school buddies by re-registering his old email. At first he was just very confused, then I realised he had probably used that address as a recovery email for a bunch of stuff, and was able to recover passwords for his new email address. Lucky for him I'm not the kind of person to take a joke too far.

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by icebraining on Monday August 27, 2018 @07:23AM (#17850726)

Reset password, delete account, then create a new one?

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by sbarre on Monday August 27, 2018 @07:38AM (#17850790)

Not all services make it easy to delete accounts, and even in some cases because they soft-delete stuff (let's not get into the problems with that), you still can't use an email that was previously used.

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by rahimnathwani on Monday August 27, 2018 @11:21AM (#17852004)

Change the email address for accounts you can't delete to jon2@

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by Freak_NL on Monday August 27, 2018 @07:40AM (#17850801)

Add a tag:

    [email protected]

If the service will accept that of course. It's perfectly valid, and you'll know if it works when you get the confirmation email.

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by bdcravens on Monday August 27, 2018 @09:44AM (#17851438)

While common, I don't think this is a standard, so it will vary by service provider or email server. According to spec, "+" can be a valid part of an email address:

    Without quotes, local-parts may consist of any 
    combination of alphabetic characters, digits, or any of 
    the special characters

        ! # $ % & ' * + - / = ?  ^ _ ` . { | } ~

https://tools.ietf.org/html/rfc3696#page-5

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by GoodDreams on Monday August 27, 2018 @10:08AM (#17851551)

I’ve had many experiences where one day a site will stop handling + correctly and I can no longer sign into my account. More common is the registration form allows + but the sign in does not, or I can subscribe to an email newsletter but not unsubscribe.

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by nkrisc on Monday August 27, 2018 @09:55AM (#17851482)

As far as the service is concerned, that's simply an entirely different email address. You might as well do [email protected]. Since you control domain.tld, you can of course receive any email sent to it.

But the point the GP was making is that email addresses are treated by services as if the will always be tied to the same person, but that's simply not true.

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by cbluth on Monday August 27, 2018 @06:10PM (#17854989)

This only works with Gmail, and copycats

[ Parent | on HN ]

Re:Hacking law firms with abandoned domain names by swalsh on Monday August 27, 2018 @11:52AM (#17852181)

I worked for a conglomerate a few years ago but had a simple email. I realized my email was recycled after I started receiving all kinds of unusual emails... like emails for an old personal eBay account. It was funny at first, but it was definitely a security liability for himself and the company as I was occasionally sent emails I'm sure I should not have been included on (he was a higher level, and was part of several mailing lists that were not purged after he left).

[ Parent | on HN ]