News for hackers. Stuff that matters.
Re:Ask HN: What’s the deal with random people sending me mon... by NikolaNovak on Saturday June 03, 2023 @03:50PM (#36179931)
I'm a paranoid nerd enough that this was an actual conversation I had with my wife - should we give our kids a name combination unique / obscure enough to mitigate the risk?

What drives me insane is that 99 % of companies send "please confirm your email address"... And then have NO link to say "that's not me!". You can click for positive confirmation but you can click for negative confirmation. And they keep the account even though it's unverified email. Even though I never verified the email, I'm subscribed to ridiculous amount of Financial, retail and other services throughout Europe due to this issue (people inadvertently subscribing with my email address).

Re:Ask HN: What’s the deal with random people sending me mon... by xp84 on Saturday June 03, 2023 @04:12PM (#36180097)
Personally I think a non-unique name is best for security concerns, all things considered. You don’t want one ex-boyfriend or whatever to be able to find every last trace of your online existence, trivially, for the rest of your life, just by knowing your name. It is better that it’s going to be mixed in with tons of chaff from all the other Greg Jacksons or Catherine Williams (or whatever the applicable culture’s normal names are).
Re:Ask HN: What’s the deal with random people sending me mon... by Eduard on Saturday June 03, 2023 @04:37PM (#36180318)
Kinda weird, considering the whole idea of double opt-in is to only start spamming you once you actively consent via e-mail action
Re:Ask HN: What’s the deal with random people sending me mon... by NikolaNovak on Saturday June 03, 2023 @07:13PM (#36181417)
It's not just marketing emails. I get invoices, quotes, proposals, contracts, dating site messages, all sort of things. None of those designers / sysadmins / owners apparently feel email should be verified before sending that stuff. Why bother with verification emails then? I haven't a clue.
Re:Ask HN: What’s the deal with random people sending me mon... by genewitch on Saturday June 03, 2023 @09:45PM (#36182236)
not sending emails earns their companies $0. Sending emails ostensibly earns their companies greater than $0
Re:Ask HN: What’s the deal with random people sending me mon... by zimpenfish on Saturday June 03, 2023 @04:24PM (#36180199)
> And then have NO link to say "that's not me!"

I add those destination email addresses to the system filter as a hard reject. I assume the other end will get the message eventually.

Even having a "it's not me" link doesn't always help if they use a different email each time - for a while, I was getting 3-5 Russian Instagram "confirm your email"s a week and the "it's not me" made no visible difference.

Re:Ask HN: What’s the deal with random people sending me mon... by rationalist on Saturday June 03, 2023 @05:31PM (#36180727)
Sounds like spam, I would mark it as such.
Re:Ask HN: What’s the deal with random people sending me mon... by NikolaNovak on Saturday June 03, 2023 @06:40PM (#36181199)
The email bothers me a little.

What bothers me a lot is that there's an active account attached to my email address with dozens of companies I did not choose to engage with. It as astonishing how few companies allow you to disavow an account created with your email (practically none. I don't have an instagram myself but my email account does.)

Marking their emails as spam just means I will no longer know what's being done "in my name" (with my email address). It doesn't aftually solve an issue in any real way.

Re:Ask HN: What’s the deal with random people sending me mon... by hedora on Saturday June 03, 2023 @10:22PM (#36182445)
You could always email the company, or just validate the email, reset the password and delete the account.

The latter is risky though; some sites use email validation as proof they should attest to the real world identity of the person that owns the account. (Github is one such example).

I imagine some site does that and also does not ensure that access to the email address is enough to reset the password and 2FA setup. (Come to think of it, Github is also an example of this.)

Either way, common courtesy would dictate waiting a week or so between emailing and nuking the account.