Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Monitor

monitor.firefox.com

Post reply on HN
Print view View original

171–180 of 227 posts

Re: Firefox Monitor

#171

Post by jperras »

djsumdog wrote: post #140
27182818284 wrote: post #117

Earlier quoted context omitted.

You can use the + trick and . trick with Gmail addresses too. I think Outlook as well supports the + trick. The only downside to this is that there are plenty of sites that don't accept a + either knowingly or unknowingly.

I think most MTAs support +. Isn't that part of the e-mail standard?

It is, but many services will (incorrectly) prevent an address with a `+` in it from ever making it to their database/whatever.

So the fact that the MTA will route it is irrelevant if it never makes it to the MTA in the first place.

Re: Firefox Monitor

#172

Post by ReidZB »

StavrosK wrote: post #74
sleavey wrote: post #55

Earlier quoted context omitted.

> I want to know who betrayed me. You can run your own email server (or have a company host a private domain for you), set up a catch-all address that only you know, then use a different email address for every site you sign up to. That way you can find out this sort of information. Using this technique, I know for example that spammers obtained the address I signed up to Stack Overflow with. The email is not shown o…

Fastmail supports this natively (and is awesome). You can do service@user.yourdomain.com and it will get delivered to user+service@yourdomain.com.

You can also set up rules like *@example.com, leading to addresses like hn@example.com.

Re: Firefox Monitor

#173

Post by _x5tx »

It looks like they don't have the Onliner Spambot database, as my email is not flagged but when I look at the haveibeenpwned website it flags for this spam list.

Re: Firefox Monitor

#174

Post by FireBeyond »

djsumdog wrote: post #140
27182818284 wrote: post #117

Earlier quoted context omitted.

You can use the + trick and . trick with Gmail addresses too. I think Outlook as well supports the + trick. The only downside to this is that there are plenty of sites that don't accept a + either knowingly or unknowingly.

I think most MTAs support +. Isn't that part of the e-mail standard?

The MTAs do. Many a website won't allow you to use this syntax for a user registration.

Re: Firefox Monitor

#175

Post by DGAP »

tialaramex wrote: post #160
dewey wrote: post #42

Earlier quoted context omitted.

How does the password matter though? Won’t it usually be some hashes anyway and if you are breached you should just change your password anyway.

Some bad guys (and it doesn't have to be many) specialise in taking credentials that were leaked (e.g. "bob@example.com has password Superman45") and trying them on every service they can to "crack" more accounts. This is called "Credential stuffing". Since this can be heavily automated the returns don't need to be large. e.g. maybe you can spend $100 and crack 5000 accounts with a new site that's suddenly hot, you s…

And if you use 2FA, then it raises the cost of compromising your account to that of a targeted phishing attack at worst. That's an entirely different threat model.

Re: Firefox Monitor

#176

Post by Fins »

groovecoder wrote: post #128
Fins wrote: post #124

Earlier quoted context omitted.

Just signed up, and it send breach notifications to individual emails, not the main one... Still, great job!

Your initial report emails will always go to the affected email addresses. But future breach alerts will be sent to the Primary address. (If you select that in your preferences.)

Ah, OK. I expected that if I add a new address when already having the preference set for sending notices to the main one, they would go to the main one.

Re: Firefox Monitor

#178

Post by ghostbrainalpha »

h1d wrote: post #144
ghostbrainalpha wrote: post #139

Earlier quoted context omitted.

Are you suggesting buying a new domain for each email address? That could get extremely expensive to maintain. I bought a single domain @MyEmail.org, and create a new user for each site I sign up with that forwards to my gmail. 1@MyEmail.org, 2@MyEmail.org, 3@MyEmail.org etc...

No. Your case works for a single person but for more people on a single domain, you would want to do, service1@me.your.domain service1@dad.your.domain (Instead of me+service1@your.domain) service2@me.your.domain service2@mom.your.domain and so on. So, those services have no way of fooling you by tampering with the alias parts. But of course this isn't easy unless you roll your own mail server.

Thanks for the breakdown. I didn't think about using Sub Domains!

Re: Firefox Monitor

#179

Post by mehrdadn »

kps wrote: post #84
bennylope wrote: post #72

Earlier quoted context omitted.

I do this with Fastmail, including specialized subdomains to help me segment the addresses and then distinct email names for each sign up as necessary. You can also do something similar with Gmail (and probably other providers) using "+" in your username, e.g. "myname+hackernews@gmail.com". This creates a unique email address that delivers to your Gmail account as if the "+ " were absent. This is more easily defeated…

If you run your own email, you can catch the moderately motivated spammer: use a character other than + as the segmenter, and a honeypot +. Here, ‘-’ is the segment character, is the actual delivery address, and triggers an immediate block.

> triggers an immediate block.

This doesn't work. I've seen legitimate companies just strip everything from the + onwards.

Re: Firefox Monitor

#180

Post by mehrdadn »

sneak wrote: post #135
stevesimmons wrote: post #105

Earlier quoted context omitted.

Those don't meet the required standard of "an unambiguous indication by clear affirmative action" according to the UK ICO's interpretation of GDPR: https://ico.org.uk/for-organisations/guide-to-data-protectio... "You cannot rely on silence, inactivity, pre-ticked boxes, opt-out boxes, default settings or a blanket acceptance of your terms and conditions."

What kind of world do we live in where using a free service and agreeing to explicitly documented T&Cs doesn’t constitute acceptance? “You provided a contract, and I agreed even though I chose not to read it (despite you providing it), and used the service, but I didn’t really mean to agree” is the most ridiculous cop-out, in my view.

> What kind of world do we live in where using a free service and agreeing to explicitly documented T&Cs doesn’t constitute acceptance?

A world where a clause doesn't become valid just because it's in a contract. That's why various jurisdictions rule void kinds of clauses, even in the US. This isn't a new concept.

Post reply on HN