Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why was my email leaked?

forums.dropbox.com

Post reply on HN
Print view View original

211–220 of 265 posts

Re: Why was my email leaked?

#211

Post by signed0 »

GhotiFish wrote: post #140
signed0 wrote: post #96

Earlier quoted context omitted.

That sounds like a fun idea for an app/service. You provide it with your base email address or custom domain and it generates a couple random words and keeps track of what service you used it to sign up for.

I spent a little time thinking about this concept and how it relates to just having dummy account you control, for giving to services you don't fully trust. As long as you use a secure password, and you don't use the same one. I don't see alot of difference, but the ability to sandbox each service to a list of email accounts, so that the attacker never knows the master account, would be an extra layer of security. Ut…

A better option might be integrating it into LastPass or 1Password. They already generate a random password for you, why not an email address as well?

Re: Why was my email leaked?

#212

Post by SomeCallMeTim »

sordidfellow wrote: post #124
doktrin wrote: post #93

Earlier quoted context omitted.

Especially considering the context. It seemed pretty clear that the user was posting the email address publicly for the first time. That is just awful, and is an awkward example of why you may not want unpaid, mostly un-vetted volunteers as the public face of a company.

Thank you! I was wary of this thread showing up on HN because I felt I was a bit unkind when posting in that thread, but Chris' comment towards me seemed completely unjustified. And he deleted a prior post along the same lines, hence why I quoted him on my next post.

I also use unique addresses for every site, and while my Dropbox email wasn't compromised, I've occasionally gotten that response from tech support elsewhere.

You mean that tim-somespecificsite@mydomain.com was randomly compromised, but NO OTHER random email was mailed to me? No, that's not how spammers work. If they'd decided to spam tim-*, I would have gotten hundreds of emails...sigh...

Re: Why was my email leaked?

#213

Post by nwh »

GhotiFish wrote: post #140
signed0 wrote: post #96

Earlier quoted context omitted.

That sounds like a fun idea for an app/service. You provide it with your base email address or custom domain and it generates a couple random words and keeps track of what service you used it to sign up for.

I spent a little time thinking about this concept and how it relates to just having dummy account you control, for giving to services you don't fully trust. As long as you use a secure password, and you don't use the same one. I don't see alot of difference, but the ability to sandbox each service to a list of email accounts, so that the attacker never knows the master account, would be an extra layer of security. Ut…

I use something similar already. I've a domain that is used purely for my email. Normal addresses like webmaster@ are rejected. A script on the server takes the domain I am registering for a service on (eg "google.com"), generates an random-looking but deterministic address, and creates an alias for that address to my real inbox.

End result is that everyone gets a unique email that can't be guessed, I can nuke an address as soon as it starts sending me spam (often) and my true inbox is typically completely clean.

I initially made the mistake of trusting my bank and utility billing systems with my real address. Turns out my power company had their database compromised, and when I called to inform them they refused to believe me (like Dropbox).

Re: Why was my email leaked?

#214

Post by tomjen3 »

fnordfnordfnord wrote: post #192
bigiain wrote: post #133

Earlier quoted context omitted.

These (the dot and underscore separators) are a great solution, because when the spam-happy-marketroids try to get the webdevs to intentionally implement broken email address validation, they can point out all the corporate email addresses which are by-policy of the form "firstname.lastname@domain.tld"…

Yeah, so much for RFC2822. Oh well, apparently, some spammers are clever enough to grep the emails with "+" and throw away the obvious additional portion.

The author of that rfc should be shoot. Of course nobody obeys a standard which requires you to handle comments in email addresses.

Re: Why was my email leaked?

#215

Post by res0nat0r »

potatolicious wrote: post #197
unreal37 wrote: post #189

Earlier quoted context omitted.

To defend Dropbox here, those people are forum moderators and not employees of Dropbox. The first Dropbox employee to respond specifically apologized for those responses. Jumping on Dropbox for this is just going to harm other companies responding to customer support requests in a timely fashion before lawyers get a chance to review...

> "those people are forum moderators and not employees of Dropbox" They're official representatives of Dropbox, even if they are unpaid. Their behavior is entirely on Dropbox, and the fact that Dropbox has farmed out its customer support to unpaid amateurs is possibly a worse realization than the fact that the clueless person was not an employee.

Eh not really. They are community volunteers. The best part is that they can give free support in the forums without pay, and then when something esclates and they've done something wrong an actual employee can wash their hands of the situation (as they've done here) by stating they aren't actually employed by the company.

So it's a win win for Dropbox. Free forum support for low level day to day forum chatter and easily absolvable of any wrongdoing if they screw up.

Re: Why was my email leaked?

#216

Post by simmons »

nathanb wrote: post #92

Has anyone who created a Dropbox account AFTER July of 2012 noticed this spam increase? If not, it may be that the compromised list of addresses from summer of last year has finally reached evil hands.

For what it's worth, I signed up for a Dropbox account in late December, and have not received spam at the unique address I provided.

Re: Why was my email leaked?

#217

Post by [deleted] »

unreal37 wrote: post #189
wpietri wrote: post #164

Earlier quoted context omitted.

The victim-blaming was shocking to me here. The bit where Andy Y. says, "Oh, some spammer just guessed it" was funny. As if spammers needed to do dictionary attacks against the sort of tagged addresses that 0.1% of people use. But it became hilarious when he said the same thing to the guy who uses 10-random-character tags. As if they would hit upon two different Dropbox addresses like that before the sun cooled to a…

To defend Dropbox here, those people are forum moderators and not employees of Dropbox. The first Dropbox employee to respond specifically apologized for those responses. Jumping on Dropbox for this is just going to harm other companies responding to customer support requests in a timely fashion before lawyers get a chance to review...

[deleted]

Re: Why was my email leaked?

#218

Post by DanBC »

tomjen3 wrote: post #214
fnordfnordfnord wrote: post #192

Earlier quoted context omitted.

Yeah, so much for RFC2822. Oh well, apparently, some spammers are clever enough to grep the emails with "+" and throw away the obvious additional portion.

The author of that rfc should be shoot. Of course nobody obeys a standard which requires you to handle comments in email addresses.

I'm not sure I understand. Which part of that RFC are you responding to?

Re: Why was my email leaked?

#219

Post by LancerSykera »

nwh wrote: post #213
GhotiFish wrote: post #140

Earlier quoted context omitted.

I spent a little time thinking about this concept and how it relates to just having dummy account you control, for giving to services you don't fully trust. As long as you use a secure password, and you don't use the same one. I don't see alot of difference, but the ability to sandbox each service to a list of email accounts, so that the attacker never knows the master account, would be an extra layer of security. Ut…

I use something similar already. I've a domain that is used purely for my email. Normal addresses like webmaster@ are rejected. A script on the server takes the domain I am registering for a service on (eg "google.com"), generates an random-looking but deterministic address, and creates an alias for that address to my real inbox. End result is that everyone gets a unique email that can't be guessed, I can nuke an add…

A good five years ago I got two phishing emails to two unique addresses that I had used to contact a local bank. They also refused to believe me, and it was basically my fault for not securing my computer. Somehow.

Re: Why was my email leaked?

#220

Post by ricardobeat »

niggler wrote: post #206
ricardobeat wrote: post #205

Earlier quoted context omitted.

I see your intention, but the issue is not this post alone. Take a look at minm's comment history and you'll see 90% of his posts are promoting Tonido: http://news.ycombinator.com/threads?id=minm I didn't downvote his post at first because it sounded like a genuine suggestion. I consider myself deceived.

I still think you missed my point. The only way in which you could have been deceived is if you went into the discussion assuming no conflict of interest. Years of dealing with financial media and experts has rendered me incredibly cynical, so I focused on the author's claims (which, in this case, are true -- If the product acts as the website claims, the self-hosted solutions store credentials on your servers and no…

I did read that after seeing it in another thread. Thankfully HN is nothing like the financial world. I might enter a marketing forum with that mindset, but knowledge and recognition are the currencies here, not money, so the rules are a bit different.
Post reply on HN