Everyone Wants Your Email Address. Think Twice Before Sharing It
1–10 of 76 posts
Re: Everyone Wants Your Email Address. Think Twice Before Sharing It
#2Listening to Security Now Episode 961 (https://twit.tv/shows/security-now/episodes/961) highlighted a trend where sites like FoxNews.com require email sharing and agreeing to terms of service before content can be viewed. Delving into Fox News' Privacy Policy, it's clear the extent of data collection and sharing is vast, including personal and activity data, with provisions for third-party sharing for advertising. Such practices raise serious privacy concerns, especially given the extensive user profiling and data monetization involved. This approach could set a worrying precedent for content access, prioritizing data collection over user privacy (https://www.foxnews.com/privacy-policy#fi).
I don't care about Fox News specifically, but I hope this trend requiring sharing an email address to view ad-supported content doesn't become more popular. An example of this on Fox News is this article, which requires an email address to view: https://www.foxnews.com/world/navalnys-body-reportedly-found.... Technical users can limit tracking by using email relays, but this is a big ask for non-technical users.
Re: Everyone Wants Your Email Address. Think Twice Before Sharing It
#3I have multiple email addresses based on use and how much I trust the entity collecting:
- My main personal address is the most protected and only give it out to friends, bank, family, etc.
- I have another address that I give out to Amazon, ebay, couple other trusted merchants and websites.
- Next lay down, one I use for merchants I don't particularly trust like AliExpress. In addition, I only use the credit card that lets me generate a number, set max spending limit, and expiration.
- Finally I have a couple that I use for general websites that I figure either could get hacked or I don't trust at all.
While not 100% accurate, I can tell who has sold or "lost" my info based on the spam I receive. My main personal has some spam but I think it stems from contacts that had their accounts compromised and their contact list was snarfed. Overall the less I assume I can trust the other entity the more spam that account has.
It is funny how accurate the tracking is though. I can search for something on my gaming pc and then a week later I see related ads on Youtube and sometimes even Tubi. My Amazon account uses a different email address than what I used to search on my gaming pc. While my gaming pc has accessed both gmail accounts, they weren't even logged in at the same time. I suppose they rely on IP address + IP metadata and collected advertising metadata to correlate accounts.
Re: Everyone Wants Your Email Address. Think Twice Before Sharing It
#4An easier way to spin up emails for every account:
For some email providers, if you add a "+" modifier to your email address, anything after the + will be ignored and still routed to your main email address. But email systems will still treat them as unique email addresses. (So abc123+Netflix@gmail.com and abc123+nytimes@gmail.com would both be delivered to abc123@gmail.com.
This limits their ability to link your accounts against each other. And you can see if someone shares your data when you start getting hits on your Netflix email address.
Re: Everyone Wants Your Email Address. Think Twice Before Sharing It
#5It's increasingly difficult to change account's email and phone number, some services require selfie or scan of identity document. The fingerprint consisting of email and phone number is slowly becoming digital DNA.
Re: Everyone Wants Your Email Address. Think Twice Before Sharing It
#6An easier way to spin up emails for every account: For some email providers, if you add a "+" modifier to your email address, anything after the + will be ignored and still routed to your main email address. But email systems will still treat them as unique email addresses. (So abc123+Netflix@gmail.com and abc123+nytimes@gmail.com would both be delivered to abc123@gmail.com. This limits their ability to link your acc…
It seems like some backend code could easily strip the “+” and everything after it before saving an email to a database. Not sure how viable this is but I’ve also never tried it.
Re: Everyone Wants Your Email Address. Think Twice Before Sharing It
#7An easier way to spin up emails for every account: For some email providers, if you add a "+" modifier to your email address, anything after the + will be ignored and still routed to your main email address. But email systems will still treat them as unique email addresses. (So abc123+Netflix@gmail.com and abc123+nytimes@gmail.com would both be delivered to abc123@gmail.com. This limits their ability to link your acc…
> This limits their ability to link your accounts against each other
This sounds extremely naive to me. Why would it limit their ability when this feature of gmail has been publicly known forever? All they need to do is ignore everything after the plus when cross-referencing accounts.
Re: Everyone Wants Your Email Address. Think Twice Before Sharing It
#8Simplelogin has solved this for me. Took a bit of setting up to change over emails but I'm glad I did.
Re: Everyone Wants Your Email Address. Think Twice Before Sharing It
#9An easier way to spin up emails for every account: For some email providers, if you add a "+" modifier to your email address, anything after the + will be ignored and still routed to your main email address. But email systems will still treat them as unique email addresses. (So abc123+Netflix@gmail.com and abc123+nytimes@gmail.com would both be delivered to abc123@gmail.com. This limits their ability to link your acc…
It seems like some backend code could easily strip the “+” and everything after it before saving an email to a database. Not sure how viable this is but I’ve also never tried it.
They could, but I'd be surprised if they do.
Firstly, we can see that they're using the email exactly as provided (for sending, at least), else filters on the mail we receive wouldn't work.
Secondly, the + trick works because it's valid in email addresses under RFC 5321 and RFC 5322 - the fact that Gmail (and others?) direct all addresses of the format 'foo+bar@gmail.com' to the mailbox of 'foo@gmail.com' is a quirk, not a given. Anyone wanting to trim '+bar' would have to know it's safe to do so for particular providers, and I doubt anyone wants to maintain that list and do extra backend work just in case they want to share on the sly.
Re: Everyone Wants Your Email Address. Think Twice Before Sharing It
#10It's increasingly difficult to change account's email and phone number, some services require selfie or scan of identity document. The fingerprint consisting of email and phone number is slowly becoming digital DNA.
Anyone used a good SD model to make a selfie and identity document?