Re:Quora User Data Compromised
by bhauer on Monday December 03, 2018 @08:31PM
(#18595051)
Many of us who operate our own mail services use a unique email address for every web service we use. You'd be surprised how many of these unique email addresses I've received spam at (and have subsequently blackholed). I would estimate less than 50% of the associated services ever report a data breach event. I figure either there has been an unreported breach or, possibly more likely, the service sold their userlist either directly to spammers or sold it to another group who was themselves breached. The upside, though, is that blackholing an address used for a single service is super simple and satisfying.
[ Parent
| on HN ]
As an anecdote to that:
I've received recruiter spam to "<my_email>[email protected]". Turns out when I was forced to signed up for an Adobe account years ago I'd added "+fuckyouadobe" to my email and, of course, Adobe was inevitably hacked. The leaked database had somehow made its way into recruiter software. The recruiter told me their vendor and when I got in touch with them (Aevy.com) they, of course, had no idea how that email got there.
Sadly these days people are probably smart enough to strip out these additions to gmail addresses. I would guess that's what Aevy did after I reached out...
Re:Quora User Data Compromised
by anotherevan on Monday December 03, 2018 @08:58PM
(#18595257)
I do something similar using https://www.spamgourmet.com/
Although many services are getting wise to many of these services and not let you sign up with their domains.
I would guess most companies are not in the business of selling their user email lists, but rather, shared the user's email with a third-party company that provided some service, and that third-party company then sold it.
Re:Quora User Data Compromised
by _coveredInBees on Monday December 03, 2018 @09:14PM
(#18595396)
You can do this with a gmail account too. If your email address is [email protected] following addresses all fwd to your main address
[email protected] Etc...
I used to use this technique for many years, but occasionally ran into issues with form validators rejecting the email address. I finally stopped because I never got spam from those email addresses (even in spam folder). I figured it's trivial for spammers to strip out the extra text, any half-decent spammer should know this trick. Also, I suspected they might change the +text to put the blame on someone else.
Re:Quora User Data Compromised
by ALittleLight on Monday December 03, 2018 @09:22PM
(#18595453)
Can't the spammer just s/'\+.*@'/'@'/ or something and throw away the + sign and all that follows? Or the company could do this if they were selling your email address.
Re:Quora User Data Compromised
by tedunangst on Monday December 03, 2018 @09:54PM
(#18595678)
While we're on the subject, all combinations of dots are equivalent. this.isme and th.isisme and thisis.me, etc. Finite variety, but good enough for a few generic throwaways and never filtered or stripped that I've seen.
I use [email protected] combined with a catch-all address for that sub-domain. It gets around various email validation regexes that won't accept +.
Do you have any more info on running your own mail server? I looked at doing so but was promptly steered away because of blacklisting, servers that allow it and redundancy.
Can't recommend FastMail enough- it has aliases which automatically forward mail from [email protected] to your [email protected] - This is very similar in practice to the + trick with gmail[1] but with the benefit that your email addresses will pass all stupid Javascript email validation rules.
You can also set up wildcard aliases, e.g. I have the equivalent of *@example.com, leading to addresses like [email protected].
Been using Fastmail for ages... great provider.
I'm not sure what the up or downsides would be, but I personally just have all mail sent to *@mydomain.tld forwarded to a single email address. This way I can give each service a unique email address, while preserving the ability to divine whether a particular address has been lost or stolen, by looking at the sent to field.
Well, there's the obvious comfort of having all your mail in one place -- and all the obvious disadvantages that entails, I suppose.