Live data from Hacker News

Analysing the alleged Minneapolis police department “hack”

troyhunt.com

91–100 of 102 posts

Re: Analysing the alleged Minneapolis police department “hack”

#91
post #90
post #89

Earlier quoted context omitted.

That works for GMail but not for a lot of other email providers.

Isn't that part of the email RFCs for 2 decades or so? Postfix certainly supports this for quite a while now. Edit: sendmail and qmail, too, apparently: https://www.cs.rutgers.edu/~watrous/plus-signs-in-email-addr...

Too bad Comcast/Xfinity and other ISPs don't really provide up-to-spec email clients or servers. Who cute.old.couple@comcast most likely uses.

Re: Analysing the alleged Minneapolis police department “hack”

#92
post #19
post #13

Earlier quoted context omitted.

Read the wikipedia page, its pretty accurate. There have been arrests for 'Anonymous' hacks but it's not really a group, more so an idea.

You're totally right and I shouldn't have referred to them as one entity. Even so, I think that Twitter accounts "representing" Anonymous spreading misinformation really discredits the work other Anonymous members do.

> the work other Anonymous members do

such as?

Re: Analysing the alleged Minneapolis police department “hack”

#93

Earlier quoted context omitted.

shopify has a similar thing, a two stage login where you sign in with your email then choose your account.

Microsoft has their notorious "is this account personal or issued by company it department" (or something like that) question when you login. Which is the reason it very often takes two tries and several minutes to get logged in as I never seem to guess the correct answer to that question...

You can create a personal account with Azure or Microsoft more generically with your work email address, eg you@work.com. Because this was set up by you, you could conceivably change it to you@freemail.com.

However your organization may then do a deal with MS for Azure, or MSDN subscriptions, etc. And they’ll issue a login with the same email* address you@work.com — you now have two accounts tied to the same email, one which you created by yourself and one which your IT department created for you. There’s no way for you to change this second one. Typically authentication for the second one will happen via your org’s single sign on.

So the answer to “is this account personal or issued by your IT dept” really means — did you create the account yourself? Or was it provisioned for you by IT?

* Many orgs by default don’t use email to log in. Instead a “username” like jsmith is used instead. However while interfacing with Azure it seems to be a best practice to use email.

Re: Analysing the alleged Minneapolis police department “hack”

#94

> it's extremely unusual to see the same email address with multiple different passwords in a legitimate data breach as most systems simply won't let an address register more than once I've actually built a system which did this years ago, over our initial protestations, and the reasoning went like this: Our client (this was a white label product) has lots of elderly couples as customers, these are our end users and…

nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com

So like usernames, except very awkward and Google-only.

Re: Analysing the alleged Minneapolis police department “hack”

#95

Earlier quoted context omitted.

Microsoft has their notorious "is this account personal or issued by company it department" (or something like that) question when you login. Which is the reason it very often takes two tries and several minutes to get logged in as I never seem to guess the correct answer to that question...

You can create a personal account with Azure or Microsoft more generically with your work email address, eg you@work.com. Because this was set up by you, you could conceivably change it to you@freemail.com. However your organization may then do a deal with MS for Azure, or MSDN subscriptions, etc. And they’ll issue a login with the same email* address you@work.com — you now have two accounts tied to the same email, o…

And some B2B+B2C SaaS products (Box/Dropbox/etc), when encountering this situation, only let 1 account exist. When the IT department tries to provision a conflict, instead of being provisioned, the personal account goes into an "invited to assimilate" status. The end user gets an email asking them to allow their account, which was created personally, to be converted to one managed by the enterprise admin. The user gets an opportunity, before the IT admin has control, to migrate personal data out (if they want the account converted) or change the email address to something that wouldn't conflict (if they want 2 accounts).

Re: Analysing the alleged Minneapolis police department “hack”

#96

Earlier quoted context omitted.

nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com

So like usernames, except very awkward and Google-only.

Not really. I'm assuming the reason you'd share an email is so that you only need to be logged into one account in your mail client.

Easier to remember than a username because it's guaranteed to not be taken, so you can use the same email everywhere: email+name@provider.tld. Where as "alice" probably is taken.

Also should work with any email provider, it's part of the standard.

Re: Analysing the alleged Minneapolis police department “hack”

#97

Earlier quoted context omitted.

So like usernames, except very awkward and Google-only.

Not really. I'm assuming the reason you'd share an email is so that you only need to be logged into one account in your mail client. Easier to remember than a username because it's guaranteed to not be taken, so you can use the same email everywhere: email+name@provider.tld. Where as "alice" probably is taken. Also should work with any email provider, it's part of the standard.

Unfortunately, places that don't accept + characters as valid in email addresses is really common. :( Even though it's part of the standard. :( :(

Re: Analysing the alleged Minneapolis police department “hack”

#98

> it's extremely unusual to see the same email address with multiple different passwords in a legitimate data breach as most systems simply won't let an address register more than once I've actually built a system which did this years ago, over our initial protestations, and the reasoning went like this: Our client (this was a white label product) has lots of elderly couples as customers, these are our end users and…

nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com

The number of websites that prevent me from doing this, because somebody wrote a shitty regex to invalidate most punctuation in an email address, is infuriatingly high.

Re: Analysing the alleged Minneapolis police department “hack”

#99

Earlier quoted context omitted.

nice.old.couple+alice@gmail.com nice.old.couple+bob@gmail.com

The number of websites that prevent me from doing this, because somebody wrote a shitty regex to invalidate most punctuation in an email address, is infuriatingly high.

Haven't had a problem with a lot of popular services, only Sling so far. Even my local utilities let it fly.

Re: Analysing the alleged Minneapolis police department “hack”

#100

Earlier quoted context omitted.

So like usernames, except very awkward and Google-only.

Not really. I'm assuming the reason you'd share an email is so that you only need to be logged into one account in your mail client. Easier to remember than a username because it's guaranteed to not be taken, so you can use the same email everywhere: email+name@provider.tld. Where as "alice" probably is taken. Also should work with any email provider, it's part of the standard.

The only mail provider I ever heard of this working with is Google. And if you already support multiple usernames per email address, why not support using the same username for different email addresses? It's not like leaving it blank couldn't be valid, too. After all, it's the combination of email + username that is the actual DB key, just like it is with email+name@provider.tld

If the intent is to allow two people to have independent accounts even while using an email they both control, offloading that to the email protocol seems broken to me. It's the exact same email address from the perspective of security. Anything coming after the plus sign should be ignored for the DB key, but kept around for sending emails, so it can still be used for filtering those emails (for convenience, not security). So they could sign up either as

    alice 
    bob 
or as

    alice 
    bob 
but that difference should only ever matter for their email filtering, not for identifying them.
Post reply on HN