Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why was my email leaked?

forums.dropbox.com

Post reply on HN
Print view View original

181–190 of 265 posts

Re: Why was my email leaked?

#181

Post by alexanderh »

neilkelty wrote: post #165
WestCoastJustin wrote: post #23

Brutal customer service! Especially since a user is giving you a heads up about a possible breach and leakage of their personal information. I can fathom these types of replies if this was behind closed doors, but when you have an open forum like this, you are asking for trouble with snotty replies. This forum should be a PR beacon for awesome customer support!

Those aren't Dropbox employees.

This is correct, but also irrelevant.

They are representing the company as forum moderators whether they like it or not.

I agree with others that they should at least have the word "Volunteer" in their forum account title. Not just "Moderator".

You and I know they aren't dropbox employees, but I wouldn't expect most people to assume that. Thats a big problem.

Re: Why was my email leaked?

#182

Post by [deleted] »

EvanAnderson wrote: post #29
xer0x wrote: post #13

Holy crap Dropbox's moderators make me want to terminate my account with them.

Reading that thread was painful. I always use custom one-off email addresses for services I sign-up for and. When I've attempted to report disclosure of my email address I'm almost always met with major skepticism. It's maddening. I used to enjoy the reactions I'd get from store clerks and telephone reps when I give them my email address. "Oh, how you have an email address with our company name in it?" In recent year…

[deleted]

Re: Why was my email leaked?

#183

Post by numbsafari »

rhizome wrote: post #174
Mahn wrote: post #59

Earlier quoted context omitted.

Speaking of which, this alias system from google is great in theory, but kind of pointless in practice; spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias.

spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias. Do they in fact do this?

Yep. I know for a fact they do.

Yahoo! Plus has a much better system where you use a different base email address plus the sub-address rather than your regular address.

For example, if my account is "somebody@gmail.com" then you use somebody+dropbox@gmail.com. But with yahoo, you pick an alternate, e.g. "huggybear", and use that instead (huggybear-dropbox@yahoo.com). That way if a spammer seems the sub-addressed account, they can't send email to huggybear@yahoo.com unless they want to end up on Yahoo's blacklist.

I've had a great deal more success with Yahoo's sub-addressing than Google's.

Re: Why was my email leaked?

#184

Post by TruthElixirX »

inovica wrote: post #12

Unfortunately I have seen their customer service go downhill recently. Not sure if they are having capacity problems or something. 2 weeks ago I signed up for a trial of Dropbox Teams and it said that after the trial I would be dropped back to my Pro account. I cancelled the trial as had made my mind up not to do it and it dropped me to a free account. Several emails to support, the account manager I'd been provided…

I wouldn't be surprised if they are having problems finding support staff. I believe it was late 2011 or early 2012 they were advertising customer support positions and wanted someone with a CompSci degree and like 2 years of experience just to do customer support.

Re: Why was my email leaked?

#185

Post by inopinatus »

inovica wrote: post #12

Unfortunately I have seen their customer service go downhill recently. Not sure if they are having capacity problems or something. 2 weeks ago I signed up for a trial of Dropbox Teams and it said that after the trial I would be dropped back to my Pro account. I cancelled the trial as had made my mind up not to do it and it dropped me to a free account. Several emails to support, the account manager I'd been provided…

I've been unimpressed by Dropbox's support ever since my attempt to upgrade to 80 team users (which wasn't possible via their site in 2011) revealed an internal culture of indifference, buck-passing, and reflexively blaming the customer.

Re: Why was my email leaked?

#186

Post by driverdan »

badgar wrote: post #141
driverdan wrote: post #104

I suspect this is a MUCH larger problem than people realize and not Dropbox's fault. I've noticed in the past few months I've been getting spam to a lot of site specific emails I've used under my Gmail catch all. It's as if a spammer had access to all email addresses I've used for incoming mail. I've talked with friends and found some have had the same problem. So where are spammers getting the email addresses we've…

> So what's causing this to happen? 4. You're leaking your own email addresses. Start by looking for malware on every device you touch.

I can guarantee you that none of my devices contain malware. Like I said, a trojan Android app could be a possibility but seems unlikely.

Re: Why was my email leaked?

#187

Post by sordidfellow »

neogodless wrote: post #117
Mahn wrote: post #22

I just checked the spam folder of a gmail account I used for dropbox. Throughout the years I'd ocasionally (maybe once every two months or so) check the spam folder merely out of curiosity, but it was practically always empty. Perhaps this is just a huge coincidence but I see three spam emails sent today plus another two sent this week. Some of them have cc recipients which seem legit addresses of other people, but I…

Whoa - yeah my spam folder has two sent to "dropbox.com@ .com" From ".Вишняков@direct.nacha.org" and ".Белов@fdic.gov" with subjects of "Declined Direct Deposit payment" and "Update of the security software is required!" I do get lots of "random" spam sent to addresses like "fcbb3a43@ .com" but I can't believe the moderators really think that a "random" guess would land on " .com@ .com" sigh

Those look exactly like the phishing emails I received on my dropbox-specific email address

Re: Why was my email leaked?

#188

Post by unreal37 »

This dropbox forum is exploding. Fascinating to watch.

As an aside, who knew so many people had "dropbox only" email accounts. One guy with 10 random letters/numbers he uses only for dropbox. Wow. Is this a thing?

Re: Why was my email leaked?

#189

Post by unreal37 »

wpietri wrote: post #164
revelation wrote: post #90

Earlier quoted context omitted.

From this forum "experience", it seems they have copied the Google model of service. They offer the support forum as a major source of support and promote heavy users to moderators or give them some other special flair. Mind you, normal users, without any inside access, information or capabilities. These users then spend their time flagging down support requests and blaming the posters.

The victim-blaming was shocking to me here. The bit where Andy Y. says, "Oh, some spammer just guessed it" was funny. As if spammers needed to do dictionary attacks against the sort of tagged addresses that 0.1% of people use. But it became hilarious when he said the same thing to the guy who uses 10-random-character tags. As if they would hit upon two different Dropbox addresses like that before the sun cooled to a…

To defend Dropbox here, those people are forum moderators and not employees of Dropbox. The first Dropbox employee to respond specifically apologized for those responses. Jumping on Dropbox for this is just going to harm other companies responding to customer support requests in a timely fashion before lawyers get a chance to review...

Re: Why was my email leaked?

#190

Post by moe »

agwa wrote: post #172
0x0 wrote: post #132

Earlier quoted context omitted.

Yeah, I've got postfix setup so I just need to add a line to a textfile with "servicename.somerandomchars[1]@mydomain" and it's starting to route to my inbox. When an address is "compromised" and starts to receive spam, I move the line to a "banned_recipients" file with an SMTP reject header listing the new email. That way, a human using an old address would get a bounce back with the new email. [1] so that the argum…

That's a nice technique; thanks for sharing it. This kind of flexibility is one of the many benefits of running your own mail server (I'm always happy to see that at least some people here are still doing that).

If you run postfix you can have that even easier; look for smtpd_recipient_restrictions and check_recipient_access in 'man 5 postconf'.

I'm running with this rule in the access map:

   /^from-.*@foobar.com$/ OK
That accepts all mail to an address prefixed with "from-" and (by default) rejects everything else. This way you can just make up the dummy-addresses on the fly.

I remember being slightly worried about using such a simple prefix when setting it up initially. However I have never received mail to a from-* address that I didn't "create". Not once in over 6 years.

And disabling an address that has turned spammy is as easy as:

   /^from-stuffit-expander@foobar.com$/ 554 No thanks.
Post reply on HN