800M Email Addresses Leaked Online by Email Verification Service

Re:800M Email Addresses Leaked Online by Email Verification ... by chii on Thursday March 07, 2019 @09:32PM (#19334634)

> if you run a full domain you can use emails as one-use affairs

or, if you use a service that lets you generate aliases, like gmail's "+", or a service like mailinator.

The problem is that the attack vector of email addresses is they are sometimes used as a username, and therefore contains more information than what is strictly required (for the purpose of a username). Leaking the "real" email address not only leads to spam, but allows a more dedicated attacker to use that email address as a starting point on a different site, or hack the email address altogether.

And with sites increasingly blocking disposable email addresses like mailinator, or disallowing email aliases, the problem can only get worse.

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by jnwatson on Thursday March 07, 2019 @10:33PM (#19334877)

Having your own domain is cheap. Generating an email that’s a function of the target website is trivial. I’ve done it for 20 years.

I can confirm the source of every email breach that contains one of my addresses.

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by dkersten on Friday March 08, 2019 @05:14AM (#19336400)

Yep, I do the same. I typically use <sitename>@sites.<domain>.<whatever> for website logins (stored in my password manager, so I don't need to think about it to login), so that if my password ever leaks, I know where it was leaked from.

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by easytiger on Friday March 08, 2019 @04:36AM (#19336237)

sadly using elite hacking skills this is easily circumvented

    p0wn3r $cat  testerm
    [email protected]
    [email protected]
    [email protected]
    [email protected]
    
    p0wn3r $cat  testerm | sed 's/+.*@/@/'
    [email protected]
    [email protected]
    [email protected]
    [email protected]

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by chii on Friday March 08, 2019 @07:43PM (#19343685)

and so if you set up your email filters right, you can find out who is doing this sort sort of "hacking" to get your real email address. What you do afterwards is up to you.

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by easytiger on Tuesday March 12, 2019 @06:01AM (#19366651)

By definition, if someone is offloading your data to a 3rd party and they sanitise the addrs, then you can't tell.

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by socialtoilet on Thursday March 07, 2019 @11:39PM (#19335141)

The "+" is not limited to Gmail, it's standard. The problem is many services with fancy mail validation don't accept it.

Does Gmail allow sending from the + addresses? There's quite an issue if somebody contacts you on that address but you reply without the alias.

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by QasimK on Friday March 08, 2019 @03:15AM (#19335971)

They do allow it, but it’s a pain to set up for each + address, especially on iOS.

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by dotancohen on Friday March 08, 2019 @07:07AM (#19336837)

I have not find a way to send email from Gmail, using either the web interface of their SMTP server, from a custom username (left side of @ symbol). I have a custom domain using Google Apps, but to send mail I use a third party SMTP server to customize the username portion of the From field.

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by zaarn on Friday March 08, 2019 @02:06AM (#19335712)

I've never had an issue using a different email for support, I always mention that I own the domain or email suffix and they can verify that if they want to (though nobody has so far).

[ Parent | on HN ]

Re:800M Email Addresses Leaked Online by Email Verification ... by 3pt14159 on Thursday March 07, 2019 @10:56PM (#19334947)

I'd forgotten about the gmail trick. You're certainly right about that. Though I will say one thing: I've not been hiding my email this past decade and—as far as I know—it has not bit me.

[ Parent | on HN ]