Are there any email services which allow basically unlimited aliases with long, random names?
I'm using my own domain right now, but that can only uncover who has leaked my data; does not provide additional privacy.
Two billion email addresses were exposed
91–100 of 470 posts
Re: Two billion email addresses were exposed
#92The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…
I don't understand... The password is the secret, right? If your mastercard login ends up in some breach, your password is protecting. You without or without vanish urls, if you have strong passwords you'll be fine.
Cybercrime has a logistics pipeline.
Harvesting potential targets is one part of it i.e. establishing someone was using an email address is the entry point. There's a lot of emails, so associating them to any particular website is right near the start. Establishing that they're active increases their value further.
The people responding to Troy here for example are technically doing that: they clearly monitor the email or still use it, so addresses which respond to up in value.
Re: Two billion email addresses were exposed
#93My data was exposed in one of the Facebook leaks and it turned out I had an old email on my Facebook account with a domain I had since let lapse and abandoned. Someone else registered the domain and tried to take over my Facebook account by sending a password reset request using it. Luckily I had 2FA and I guess Facebook's fraud alerts picked it up so It wasn't successful. I guess what I want to say is beware that ev…
One of the drawbacks of using a custom domain for personal email is you essentially have to pay for it for life, otherwise anyone can just buy your old email address if the domain expires and start receiving mail, resetting accounts... I think some folks don't fully consider this consequence when setting up a fun vanity email address or similar etc, especially now both iCloud and gmail have made it so trivial to link…
Conversely, if yahoo/google ever stop offering free email, I'll probably end up paying them much higher prices to keep going for a bit until I can transition.
If either ever stop period, especially one day to the next, FML...
Re: Two billion email addresses were exposed
#94Earlier quoted context omitted.
> Passwords are protected with an anonymity model, so we never see them (it's processed in the browser itself), but if you're wary, just check old ones you may suspect. That could mean one might be able to disconnect from the internet while checking.
No, it doesn't mean that, that's ridiculous. How would that work? Magic?
[deleted]
Re: Two billion email addresses were exposed
#95There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…
I was in the military. China stole my freaking DNA profile . I've given up on worrying about this stuff.
Gonna be a very weird day for you when China's clone army invades us.
Re: Two billion email addresses were exposed
#96Earlier quoted context omitted.
What a lot of work to capture one account.
I can think of a lot of ways that would be worth it. * blackmail the account owner * make up an illness, create a donation page and get all their friends to donate * find all connections over a certain age and disguise a phishing vector as literally anything! * so many more
A real FB account with real friends who trust it (and are rich) is worth a lot
Re: Two billion email addresses were exposed
#97Is there any real drawback to just never giving your real name or address to service providers to minimise the chance of identity theft? Most likely it’s against terms of service, but other than account suspension are you likely to suffer any legal consequences?
I mean, for some services, likes banks / credit cards, it's required..
For others, I try to stay anonymous / aliased where possible.
Re: Two billion email addresses were exposed
#98Earlier quoted context omitted.
+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.
> Bitwarden Best when paid for so you can do 2FA with TOTP codes!
I self-host through Vaultwarden but I think I miss this. Besides, I feel like paying these guys anyway just for the great product. We use 1Password at $dayjob and it's so primitive by comparison.
Re: Two billion email addresses were exposed
#99Cynicism is everywhere these days but these events really don't register for me anymore. Companies aren't punished by the government for these leaks and they aren't punished by consumers either. What incentive is there to reduce this data collection in the first place or to lock down your databases? Even if someone's security is awful as the consumer and their account gets hacked because of these leaks, what are the…
I don't care for most things, but banking is one place I've been bitten pretty hard without even getting hacked. Not going to extremes to protect it, just gonna make sure it's decent.
Re: Two billion email addresses were exposed
#100Earlier quoted context omitted.
[flagged]
HaveIBeenPwned has been around for ages and it does not send your password to the server - you can check it with the browser console. It hashes it, sends a range of the hash to the server, server replies with a list of hashes that match that range and it's checked locally for a match.
Still, I would not trust that. The password could be leaked through other means, for example by setting a timer, and exfiltrating fragments of it across future requests.
The website loads some external fonts and spits out many warnings in the console by default. Does not instill confidence in the truly paranoid hacker.