Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The joys of owning an ‘OG’ email account

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 285 posts

Re: The joys of owning an ‘OG’ email account

#111

Post by bleepblorp »

geocrasher wrote: post #3

I am really glad that I do not have one of these email accounts. While I cannot speak firsthand of some of the shenanigans that are mentioned in the article, I have worked in the web hosting industry for 20 years. I have seen some of the horrible security practices in use by customers and, surprisingly, people in the industry. I've seen many people locked out of their hosting accounts because they have their primary…

> I've seen many people locked out of their hosting accounts because they have their primary account email address as one of the hosted email addresses on their accounts, and suddenly they've lost access to their web hosting control panel because their domain expired or their email was otherwise taken offline.

This is a surprisingly difficult risk to effectively mitigate.

If you have a domain and tie your domain registration and hosting accounts to an email address hosted by the domain, you could get locked out if something goes wrong with the domain registration.

If you tie your registration and hosting accounts to a third-party email account, you could get locked out if the third-party decides to nuke your account for any arbitrary reason (cough, cough, Gmail).

If you tie your registration and hosting accounts to a cell phone number, you could get locked out if someone attacks your phone account (unauthorized porting, SIM swap, etc) or if the cell phone network goes down (think California fire protection blackouts, or hurricanes).

If you tie your registration and hosting accounts to TOTP or Webauthn 2FA, you could get locked out if you lose or damage your 2FA device.

There's no good way to authenticate domain registration and hosting accounts unless your registrar and host have the foresight to allow multiple authentication paths.

Re: The joys of owning an ‘OG’ email account

#112

Post by 1of1 »

smillbag wrote: post #109
1of1 wrote: post #92

I was recently in an Xbox party with 3 char anime/Japanese theme tags. I asked them why there weren't any numbers after their tags and they went on for two hours teaching me about OG tags and that his $750 tag was a steal as it wasn't just random letters, but an actual word. The other guy paid $1,500 and at one time paid $12,000! They explained you can buy them on IG or a site called ogusers, but that you should alwa…

Reply all did a great episode which went into these OG markets. One of their best: https://gimletmedia.com/shows/reply-all/v4he6k

Yikes, probably a nightmare for the average netizen

Re: The joys of owning an ‘OG’ email account

#113

Post by samstave »

kstrauser wrote: post #87

Ugh, this is my life. Yes, including accusations of “hacking” when someone signed up for Facebook with my email. On the plus side, this personal experience made me very adamant about protecting mistakenly-registered users at my employer. When we were planning to add logged in accounts to our service, the sales team (understandably!) wanted the signup process to be as frictionless as possible, and thought that new use…

Over a decade ago, I was added to a Sri Lanken family tree thing on Ancestry - because they invited my email address, as we have the same last name (my last name though is Norwegian, and the same as this sri lanken family.

I still get updates in my email from this family and even had bank statement updates sent to me. and birthday wishes mean for the other sstave...

I have told them multiple times - but I am still on their family tree - for a DECADE

Re: The joys of owning an ‘OG’ email account

#114

Post by OkGoDoIt »

I own the domain name for my last name, so that I have the email address [firstname]@[lastname].com. But when signing up for services I like to use my domain as a catchall so I can have unique email addresses for each service. Of course that means I receive all emails sent to anything at [lastname].com. Even though my last name is not that common, there’s apparently a ton of people with my last name who sign up for services using their first name @[lastname].com, even though they obviously don’t have access to that email address and haven’t for at least the 8 years that I’ve owned the domain name. I’ve never understood what compels a person to type in an email address for service if they don’t actually have access to that email. And yes, I see plenty of bank accounts and other important accounts as mentioned in the article. It’s mind-boggling. I also get plenty of personal email as well, intended for people with that first name and last name. In those cases I usually reply to tell them they have the wrong email address, and more than once someone has responded back again asking me if I could pass the message along to that person as if I’m supposed to know them.

Re: The joys of owning an ‘OG’ email account

#116

Post by [deleted] »

kstrauser wrote: post #87

Ugh, this is my life. Yes, including accusations of “hacking” when someone signed up for Facebook with my email. On the plus side, this personal experience made me very adamant about protecting mistakenly-registered users at my employer. When we were planning to add logged in accounts to our service, the sales team (understandably!) wanted the signup process to be as frictionless as possible, and thought that new use…

[deleted]

Re: The joys of owning an ‘OG’ email account

#117

Post by cik »

kstrauser wrote: post #87

Ugh, this is my life. Yes, including accusations of “hacking” when someone signed up for Facebook with my email. On the plus side, this personal experience made me very adamant about protecting mistakenly-registered users at my employer. When we were planning to add logged in accounts to our service, the sales team (understandably!) wanted the signup process to be as frictionless as possible, and thought that new use…

Yup, I feel your pain. One of my emails is @.com. This fails verification on so many websites it's just comical. I then figured on making a @.com. Turns out folks mostly validate .com in my experience, which I assume is because of good old mail.com. It's frustrating.

Re: The joys of owning an ‘OG’ email account

#118

Post by chillfox »

wyclif wrote: post #102
kstrauser wrote: post #87

Ugh, this is my life. Yes, including accusations of “hacking” when someone signed up for Facebook with my email. On the plus side, this personal experience made me very adamant about protecting mistakenly-registered users at my employer. When we were planning to add logged in accounts to our service, the sales team (understandably!) wanted the signup process to be as frictionless as possible, and thought that new use…

My main email address is @gmail.com. My surname is not a very common one, yet I still experience many of the side effects described here. I've had this account since the first day Gmail was available to the public, April 1st 2004—I was invited by a friend who worked for Google at the time. Back then, I never considered this address an "OG" address, but then around 2012 I noticed something funny. I volunteered to do s…

Most people with average computer literacy has no choice but to use the fluffybunny32428 style email addresses.

To get a good email address these days you either have to be very early at jumping on a new email service or you have to be skilled enough to use your own domain.

Re: The joys of owning an ‘OG’ email account

#119

Post by ValentineC »

cik wrote: post #117
kstrauser wrote: post #87

Ugh, this is my life. Yes, including accusations of “hacking” when someone signed up for Facebook with my email. On the plus side, this personal experience made me very adamant about protecting mistakenly-registered users at my employer. When we were planning to add logged in accounts to our service, the sales team (understandably!) wanted the signup process to be as frictionless as possible, and thought that new use…

Yup, I feel your pain. One of my emails is @ .com. This fails verification on so many websites it's just comical. I then figured on making a @ .com. Turns out folks mostly validate .com in my experience, which I assume is because of good old mail.com. It's frustrating.

> Turns out folks mostly validate .com in my experience, which I assume is because of good old mail.com.

I wonder what happens with .co.uk, and other two-letter second-level domains.

Re: The joys of owning an ‘OG’ email account

#120

Post by chrismeller »

I own the domain doesnthaveone.com, so I've also gotten a ton of these types of emails. It really is shocking.

Just scrolling through the catchall for the last couple of days I see AT&T and Verizon bills, several doctor's office reminders, some medical patient portal emails (including "new test results available"), a Navy Credit Union account notice, a surprising number of reminders and test results from veterinary offices...

The only one I ever bothered trying to get sorted out was when I discovered that I seemed to be getting any HP corporate purchase order without an email address on file.

Post reply on HN