61–70 of 141 posts
This one I learned from Troy Hunt and never looked back.
https://www.troyhunt.com/only-secure-password-is-one-you-can...
Earlier quoted context omitted.
Disagree https://www.troyhunt.com/im-sorry-but-your-email-address-is-...
This incorrectly assumes it's much more valuable to only spam people with access to a service than just a list of people, and I doubt that holds in practice
I'm not sure DocuSign has a full handle on what happened here yet. I received six (6) DocuSign emails, half of which used a convincing subject derived from actual DocuSign documents I have signed or processed through the system. Perhaps a coincidence? Or these hackers gained access to more than just "email addresses".
Earlier quoted context omitted.
I do the same with Gmail, just add + at the end (As in username+docusign@gmail.com). Of course this has the drawback of some sites being to restrictive with their checks for valid emails and not allowing the + character
If I were a spammer I'd loop through my email address list and strip out + and anything between it and @
Thanks Every Employer I've Had In the Past 6 Years For Putting My Email In A Service I'd Never Want Otherwise. Also Thanks Me for just using docusign w/ our employees when I was in charge.
Joking aside, this is an inevitable event and we just have to be cautious and ready when it does happen.
I would like to urge the Google team to solve one aspect of this problem, forever. It takes no more than 20 minutes to prototype and then approximately 1 day to fully test the final solution that is necessary on their end to keep compromised emails from being fully compromised addresses forever, without any chance for you to ever know at any point in the future where mail REALLY comes from. Here is a description: 1 -…
(Of course, you can do this, quite easily, if you run your own mail domain. You need not administer an MTA - I gather you can wire up a domain you own to Google Apps or G Suite or whatever they're calling it this week.)
Earlier quoted context omitted.
I presume canary is an established term in this context but since I don't know what it is I don't understand your service. It sounds good though.
It is coming from the canary birds in the coal mines or in submarines[0]. They have a higher sensibility to CO than humans. This is now part of the common language to say that you sacrifice an animal or "something" to get early warning of something possibly more dangerous. [0]: https://en.wikipedia.org/wiki/Sentinel_species#Historical_ex...
I would like to urge the Google team to solve one aspect of this problem, forever. It takes no more than 20 minutes to prototype and then approximately 1 day to fully test the final solution that is necessary on their end to keep compromised emails from being fully compromised addresses forever, without any chance for you to ever know at any point in the future where mail REALLY comes from. Here is a description: 1 -…
There are indeed policy implications. Each such alias reduces the available namespace, where +-aliases do not. If I had to guess why Google doesn't implement this feature, I'd guess that's the reason - their namespace is already hotly contested enough. (Of course, you can do this, quite easily, if you run your own mail domain. You need not administer an MTA - I gather you can wire up a domain you own to Google Apps o…
If this is a concern then Google can generate an immutable part of it (with high entropy), for example I said "j45rsdfjdocusign " of which "j45rsdfj" may be generated and the user may rewrite only the end of it.
The reason it's good for the user to be able to write at least part of it is so they can include the tag and not have to add it as a separate step. Otherwise, it is hard to remember where tags go.
An alternative is that during the generation the user could supply their comment which is visible only to them. (So that under this scenario j45rsdfj is generated, and you comment it with "docusign" during generation. Then if j45rsdfj receives email it is tagged with "docusign" (the comment you added during generation).
There are no other policy implications. (Though I say that with a bit more hesitation, since you did point out one minimal effect.)
By the way this has an additional benefit. Most user-chosen names don't have enough entropy. If I sent an email right now to johnsmith433 there is a 100% chance that it has already been registered by someone. Today, spammers can guess email addresses. (This is a theoretical problem only.)
If Gmail generated high entropy as part of this feature, then this would further reduce this (theoretical only) avenue for spam. I don't think this is an actual problem though - I've never heard this being described as an issue.
Earlier quoted context omitted.
Hmmm yes I have received a few and if I recall, some of them had titles very similar to docusign documents I was previously sent. Exact titles similar to this: "Accounting Invoice 630761 Document Ready for Signature"
The postmortem states that the phishing campaign used only a few patterns. "Delete any emails with the subject line, “Completed: [domain name] – Wire transfer for recipient-name Document Ready for Signature” and “Completed [domain name/email address] – Accounting Invoice [Number] Document Ready for Signature”. These emails are not from DocuSign. They were sent by a malicious third party and contain a link to malware…
Earlier quoted context omitted.
I've been doing this for awhile. It's especially interesting when giving it to a representative in person, some people will refuse to enter it in their systems. I've also had one webform reject it outright. Lately I've started just using random words to get around this awkwardness and make my pattern less predictable. When I get the first email from that company (often happens within minutes) I just give it the actua…
AliExpress does this, they don't accept "aliexpress@foo.bar". I suppose it's meant to stop you from providing "foo@aliexpress.com", implemented lazily by rejecting anything that contains the substring "aliexpress". Best response I've received when giving an email address of the form "company@mydoma.in" to a representative in person was "oh you work here too?". The concept of catch-all domains is so foreign to most la…