Live data from Hacker News

Firefox Monitor

monitor.firefox.com

201–210 of 227 posts

Re: Firefox Monitor

#201
post #135

Earlier quoted context omitted.

What kind of world do we live in where using a free service and agreeing to explicitly documented T&Cs doesn’t constitute acceptance? “You provided a contract, and I agreed even though I chose not to read it (despite you providing it), and used the service, but I didn’t really mean to agree” is the most ridiculous cop-out, in my view.

Firstly a Contract is a Meeting of Minds, the forty pages of small type in a PDF are nice, but it's laughable that you pretend you thought everybody read those before using your free service. And if they didn't read them, they clearly cannot agree with just every random term you threw in there and so it can't all be part of that meeting of minds, so there is not, in fact, a contract with people with those terms. OK,…

> The GDPR says that you need to have the user explicitly opt in,

No it doesn't.

Re: Firefox Monitor

#202
I don't understand what the point of this is. HaveIBeenPwned exists, they acknowledge (and use) their service, and offer the same exact services as they do. What's the point? It's just a reskin.

Re: Firefox Monitor

#203

Earlier quoted context omitted.

Fastmail supports this natively (and is awesome). You can do service@user.yourdomain.com and it will get delivered to user+service@yourdomain.com.

You can use the + trick and . trick with Gmail addresses too. I think Outlook as well supports the + trick. The only downside to this is that there are plenty of sites that don't accept a + either knowingly or unknowingly.

I've been doing this for years with Gmail but the issue with breach notification services like HIBP / Monitor is that you can't add wildcards into your search for notifications, so unless I plug in every me+service@domain email variant in, I could be missing being notified.

Re: Firefox Monitor

#204

Earlier quoted context omitted.

The + feature long predates gmail. Here’s an example description from the 1990s http://www.faqs.org/faqs/mail/addressing/index.html

Yes, it's in the SMTP RFC.

To clarify the SMTP RFC (RFC 5321) says that a valid e-mail address is defined in RFC 5322 - Internet Message Format.

RFC 5322 does say that a `+` is a valid character in the local part of an e-mail address.

The `+` character being used for address aliasing is, as far as I can tell, not mentioned in RFC 5321 or RFC 5322

Re: Firefox Monitor

#205

Earlier quoted context omitted.

Same, for me it was them and Apollo. I can't find anything about either of them in my mail, but both claim to have notified their customers. That's very suspicious. I don't delete anything... Perhaps it found its way into my spam and got auto-deleted (entirely possible with Apollo, seems very unlikely with MFP).

Also got mine leaked from FitnessPal and Apollo and them only. No idea what Apollo is or how they got my stuff. Any idea what it is? A link to each service's website would be awesome in the breach report on FireFox Monitor.

Had the same. Seems Apollo is https://www.apollo.io - you were probably entered as a sales lead.

Re: Firefox Monitor

#206

Earlier quoted context omitted.

Yeah, that's why Fastmail has that syntax.

The + feature long predates gmail. Here’s an example description from the 1990s http://www.faqs.org/faqs/mail/addressing/index.html

I think StavrosK meant Fastmail has the service@user.yourdomain.com syntax because "there are plenty of sites that don't accept a +", not because Gmail supports the user+service@gmail.com syntax.

Re: Firefox Monitor

#208

Earlier quoted context omitted.

Then what?

I usually go for @example.com where is the company I’m handing my address to. After a breach I route that address to /dev/null

That's trivially easy to guess -- and game.

You want something that is sufficiently random that it can't be easily guessed or gamed, but can be quickly and easily determined on your side.

Salted cryptographic hashes might be a good place to start.

Re: Firefox Monitor

#209

Earlier quoted context omitted.

I think most MTAs support +. Isn't that part of the e-mail standard?

It is, but many services will (incorrectly) prevent an address with a `+` in it from ever making it to their database/whatever. So the fact that the MTA will route it is irrelevant if it never makes it to the MTA in the first place.

> It is [part of the standard]

+ as a magic character to effect routing isn't part of the standard. Mail servers are free to route addresses to mailboxes in whatever manner they see fit. That + can appear as a character in an address is part of the standard, just not the behavior of it; a server that treats a+1@ and a+2@ as distinct emails is conforming, and from a sending side, you cannot know if a+1@ and a+2@ will end up in the same mailbox.

(But you're absolutely right that too many sites fail to parse email addresses. Or rather, they over-parse.)

Re: Firefox Monitor

#210
post #204

Earlier quoted context omitted.

Yes, it's in the SMTP RFC.

To clarify the SMTP RFC (RFC 5321) says that a valid e-mail address is defined in RFC 5322 - Internet Message Format. RFC 5322 does say that a `+` is a valid character in the local part of an e-mail address. The `+` character being used for address aliasing is, as far as I can tell, not mentioned in RFC 5321 or RFC 5322

It's apparently a thing now:

https://tools.ietf.org/html/rfc5233

Post reply on HN