Why was my email leaked? • Hacker News Board

Re: Why was my email leaked?

#71

Post by ubercow13 » Thu, Feb 28, 2013, 8:50 PM UTC

danielweber wrote: post #34

Khao wrote: post #4

The way the moderators handled this was pretty damn bad. Two different users tell the moderator they use UNIQUE e-mail addresses for dropbox only, and they received spam roughly at the same time and yet the moderator answers by assuming the users are idiots.

The way some people do "fredsmith+amazon@gmail.com" as proof that it must be amazon that leaks their passwords has some issues. The guy who says that he had a truly random bunch of letters as his dropbox account is probably a better indicator, but it's hard to know if the guy ever leaked it himself. Doesn't excuse the moderators being jerks, though.

Some of the posters seem to be saying they have received spam on a single, dropbox-specific address on their own domains, though, presumably with catch-all email, so that an attacker wouldn't just have had to guess fredsmith.dropbox@fredsmith.com, but also not tried a single other address @fredsmith.com

Re: Why was my email leaked?

#72

Post by footrap » Thu, Feb 28, 2013, 8:51 PM UTC

res0nat0r wrote: post #35

xer0x wrote: post #13

Holy crap Dropbox's moderators make me want to terminate my account with them.

Those mods don't work for Dropbox, they are community volunteers who've just been given mod permissions.

That doesn't matter in the slightest.

This is the company's OFFICIAL forum, and therefore the conduct of the appointed "moderators" reflects that of the company.

Re: Why was my email leaked?

#73

Post by danielweber » Thu, Feb 28, 2013, 8:51 PM UTC

ddrager wrote: post #60

What about the possibility that end-users' computers are breached? - User/pass is saved in the 'Remembered password' area of browser (this is decodable by malware) - Email is screen-scraped by malware - Email is sniffed during login at a wifi hotspot (Password is encrypted, user/email may not be) - 3rd party apps that are linked to your dropbox account I'm not saying that this wasn't caused by the database breach, bu…

Yeah, it's tough to really know who leaked. Alice and Bob both know secret S, and each can blame the other if S is leaked, but neither of them really knows who did it.

There have been some research projects where unique and unguessable passwords were made in laboratory conditions and securely given to sites to see if they managed to leak. I trust those a lot more because they often lock up the email addresses and never use them. From what I recall some big companies did give out addresses they promised not to, but that's not a blanket condemnation of all businesses.

Re: Why was my email leaked?

#74

Post by ISL » Thu, Feb 28, 2013, 8:51 PM UTC

tjbiddle wrote: post #44

inovica wrote: post #20

Earlier quoted context omitted.

Yeah thats exactly what happened :) No other way to contact them and the account manager I dealt with hasn't responded either. Just counted and I've sent them 6 emails so far and zero response. Its such as shame as I have raved over Dropbox (partly as its Python which I also love), have 4 Pro accounts with my team and we were looking to sign up with 15 users to a Teams account. Looks like I'll be moving somewhere els…

If you'd truly get a faster response being a Pro member, then it might be worth a shot to purchase Pro again - then when they respond, have them refund you and reset your account back to it's previous time left for your membership.

Or, have one of your other Pro accounts raise the alarm for you.

Re: Why was my email leaked?

#75

Post by pyvek » Thu, Feb 28, 2013, 8:52 PM UTC

Everyone who received the spam should pastebin the emails along with the header and share them for comparison. If those spam messages are found to be similar then it can be pinpointed that they all have originated from the same person/group and it was no usual hit & miss technique by the spammers which the moderator is contemplating about.

Re: Why was my email leaked?

#76

Post by tlogan » Thu, Feb 28, 2013, 8:53 PM UTC

Mahn wrote: post #22

I just checked the spam folder of a gmail account I used for dropbox. Throughout the years I'd ocasionally (maybe once every two months or so) check the spam folder merely out of curiosity, but it was practically always empty. Perhaps this is just a huge coincidence but I see three spam emails sent today plus another two sent this week. Some of them have cc recipients which seem legit addresses of other people, but I…

I think that I tracked my spam to the following exploit:

http://thenextweb.com/insider/2013/01/31/yahoo-mail-users-st...

If you ever shared anything with somebody using Yahoo email your email is already in the wild.

Re: Why was my email leaked?

#77

Post by uptown » Thu, Feb 28, 2013, 8:53 PM UTC

What about a possible leak from a 3rd party? Did you, by chance, use Mailbox? Do third-party apps (1Password, etc.) that sync using Dropbox get access to your email address?

Re: Why was my email leaked?

#78

Post by jaibot » Thu, Feb 28, 2013, 8:53 PM UTC

Mahn wrote: post #59

danielweber wrote: post #34

Earlier quoted context omitted.

The way some people do "fredsmith+amazon@gmail.com" as proof that it must be amazon that leaks their passwords has some issues. The guy who says that he had a truly random bunch of letters as his dropbox account is probably a better indicator, but it's hard to know if the guy ever leaked it himself. Doesn't excuse the moderators being jerks, though.

Speaking of which, this alias system from google is great in theory, but kind of pointless in practice; spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias.

It's pointless in practice in theory; in practice in practice spammers (in my experience) don't target + aliases. And if you think about the set of people who are likely to give money to spammers, the set of people using + aliases, and the fraction of + alias space that is occupied versus the fraction of non-+'aliased space that is occupied, the reason why becomes clear.

Re: Why was my email leaked?

#79

Post by csense » Thu, Feb 28, 2013, 8:55 PM UTC

markdown wrote: post #46

While I can't speak for Dropbox and this specific case, we had angry customers like this two or three years ago. Obviously we were very concerned, and spent days poring over server logs and trying to figure out where the breach was. Turns out the service we used for newsletters (icontact) had been hacked. They never emailed to let us know. (They had a blog post up for a few days, then removed it, the slimy bastards!)…

This is how a company's supposed to respond to stuff like this.

Re: Why was my email leaked?

#80

Post by michaelhoffman » Thu, Feb 28, 2013, 8:56 PM UTC

robk wrote: post #57

Just checked my spam folder and sure enough 5 spam emails to my unique dropbox address.

I just did the same thing. Two phishing scams sent to my unique Dropbox address, including one from the nacha.org scam mentioned in the original thread.