Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Not OK Cupid – A story of poor email address validation

fastmail.com

Post reply on HN
Print view View original

81–90 of 123 posts

Re: Not OK Cupid – A story of poor email address validation

#81

Post by freitasm »

rixed wrote: post #77
freitasm wrote: post #74

Earlier quoted context omitted.

I have a common lastnameinitial @ email provider. It's the same username from my mainframe days. Some people with similar surname use that, probably because they either don't want to receive emails or because they are just... I don't know, clueless? Usually I takeover an account and change the password. Then add a 2FA if possible and update the details to my name and address. This way people can't say it's their acco…

Have done all that without suffering any sense of guilt ?

Yes. Also received invoices, past due notices and more.

A couple of times I contacted the companies to let them know their notices did not reach the right person. No reply or acknowledgement.

Both sides are bad. Not my problem. My problem is people using my email and creating trash in my inbox.

Re: Not OK Cupid – A story of poor email address validation

#82

Post by Semaphor »

RandomBacon wrote: post #9

Companies that allowed others to create accounts with my email addresses: PayPal, Apple, Credit Karma, Walmart (I just forwarded the email to legal@ and they took care of that instance very quickly, kudos to that at least). Edit: Forgot to add TD Bank - I actually opened a case with the Office of the Comptroller of the Currency that regulates this bank. Companies that spammed me in the last 24 hours because they don'…

Accounts: Don’t remember all, but at least Instagram, TikTok, Ebay and some dating site (not OkC) had accounts created for my mail.

Newsletter: A German plushie store (Steiff) and some kind of wellness place. 2 democratic congressmen.

In all cases it’s the same, I mark them as spam and block them.

Re: Not OK Cupid – A story of poor email address validation

#83

Post by selcuka »

ffsm8 wrote: post #78
asciimov wrote: post #75

Earlier quoted context omitted.

Accidentally signing up once is a mistake. One person signing up for products, credit cards, unemployment, medical bills, television services, payday loans, mortgages, jobs with my email address over a 6 year period isn’t a mistake. This is some middle age dude in middle America.

What gives you the confidence to say that it was a single individual and not just a common email name which lots of people accidentally used?

> What gives you the confidence to say that it was a single individual

Because you can see their first name and last name on the emails you receive.

Re: Not OK Cupid – A story of poor email address validation

#84

Post by climb_stealth »

yx827ha wrote: post #21

Fastmail's masked emails are great! I honestly very rarely give out my "real" email. Usually when I sign up for something I create a masked email, or if I need an email on the spot I use a wildcard alias (xxxxxx@myalias.fastmail.com). Since most of my emails are random, it serves as an authentication additional factor.

The problem is that it only takes one entity to leak the real email. All my spam comes on my real email despite using aliases for years.

I need to retire my real email address, but it'a bit tricky because I also used it for important things.

Haven't quite worked out how to solve that yet.

Re: Not OK Cupid – A story of poor email address validation

#86

Post by Timshel »

climb_stealth wrote: post #84
yx827ha wrote: post #21

Fastmail's masked emails are great! I honestly very rarely give out my "real" email. Usually when I sign up for something I create a masked email, or if I need an email on the spot I use a wildcard alias (xxxxxx@myalias.fastmail.com). Since most of my emails are random, it serves as an authentication additional factor.

The problem is that it only takes one entity to leak the real email. All my spam comes on my real email despite using aliases for years. I need to retire my real email address, but it'a bit tricky because I also used it for important things. Haven't quite worked out how to solve that yet.

Start now with a forward from the old address. Might take multiple years before you are confortable deleting the old address.

Re: Not OK Cupid – A story of poor email address validation

#87

Post by climb_stealth »

Timshel wrote: post #86
climb_stealth wrote: post #84

Earlier quoted context omitted.

The problem is that it only takes one entity to leak the real email. All my spam comes on my real email despite using aliases for years. I need to retire my real email address, but it'a bit tricky because I also used it for important things. Haven't quite worked out how to solve that yet.

Start now with a forward from the old address. Might take multiple years before you are confortable deleting the old address.

You may be right there. Will have a think about it. Maybe a filter to flag things and update as needed.

Re: Not OK Cupid – A story of poor email address validation

#88

Post by RandomBacon »

Terr_ wrote: post #51
DidYaWipe wrote: post #37

Ugh. Then there's the general stupidity of forcing people to use E-mail addresses as user IDs. It's not just annoying, but also a security blunder. The general public can't be counted on to understand that when they're forced to use their E-mail address as an ID, they don't have to use their E-mail account's password for it. That makes every one of these sites a gatekeeper to the user's E-mail account. All it takes i…

Related stupidity: "Security Questions" that enable someone to take over your account just by collecting not-so-secret information that is often shared because the site insists you pick from their own set of questions which other sites have already used.

Make sure it is a plausible-sounding answer.

Don't give an attacker an opportunity to social engineer and say, "it was a bunch of random letters or words" and the customer service person lets them in because it looked like someone was just typing random stuff.

(Insert xkcd here)

Re: Not OK Cupid – A story of poor email address validation

#89

Post by RandomBacon »

climb_stealth wrote: post #87
Timshel wrote: post #86

Earlier quoted context omitted.

Start now with a forward from the old address. Might take multiple years before you are confortable deleting the old address.

You may be right there. Will have a think about it. Maybe a filter to flag things and update as needed.

I went from using Gmail for 10-15 years to catch-all using my own domain name with Fastmail. It took a couple of years to slowly make the switch, but it was worth it. I still monitor the Gmail just in case and it's not a big deal, especially since you can fetch it (and send from it) with Fastmail (I just keep a Gmail tab open to report spam).

Re: Not OK Cupid – A story of poor email address validation

#90

Post by RandomBacon »

HappMacDonald wrote: post #46
RandomBacon wrote: post #17

Earlier quoted context omitted.

> The best you can hope for really is that they put a link in the email to disavow the account with one click. I've only seen a few companies do that but I really appreciate it! That's a great middle-ground, and I think I've only seen that once.

Such links might disavow in practice, or might alternately be used as "hey, this email address has a living person at the other end, update the alive status on your spam lists and sell the data point!"

I would only use that wth legitimate companies. Your scenario is no different than spammers who already have "unsubscribe" links.
Post reply on HN