Have I been pwned? Check if you have an account that has been compromised

Re:Have I been pwned? Check if you have an account that has ... by kazinator on Thursday September 11, 2014 @11:12AM (#8303015)

People who know "pwned" are probably more resistant to phishing attacks than the average schmuck.

Also, a lot of the material entered into the site will be fake. This is not a good way to harvest genuine e-mail addresses.

Not only is it open to fake addresses, but it is open to deliberate spam-trap addresses: addresses whose only purpose is to detect spam. I can generate a fake address "nothanks@<mydomain>" and feed it to this site (or, generally, allow this address to be widely harvested).

Then, whenever an SMTP request comes in with a "RCPT to: nothanks@<mydomain>", I can drop the connection and ban the IP address for 7 days. Any use of that address is 100% spam; no legitimate sender knows this address.

[ Parent | on HN ]

Re:Have I been pwned? Check if you have an account that has ... by bitJericho on Thursday September 11, 2014 @11:43AM (#8303228)

If I were to run this scam, I would only add addresses that were checked and matched a known leak. This would both give me a known good address and also an idea of what kind of person you are. If you're the type to check your email address against known leaks then I would know exactly how to attack you.

[ Parent | on HN ]