15 ms·

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately afte

• cm2187 10y ago
  I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.
  • markdown 10y ago
    > Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor. Isn't that how chip-and-pin works?
    • cm2187 10y ago
      Except that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.
      • chrisseaton 10y ago
        > the merchant still gets to see my credit card numbers (both sides) With chip and pin? I don't think they do.
        • pbhjpbhj 10y ago
          In the UK the numbers are printed on the receipt - part obfuscated on the customers copy, fully shown on retailer copy. So whilst the retailer may not touch the card they still get everything except the magic 3 digits. Where I work you need the 3 digit security code and some address numbers (which you can make up) to properly process a transaction without the card.
          • chrisseaton 10y ago
            Yes that's what I said - they don't see both sets of numbers.
        • tzs 10y ago
          Chip and PIN cards can support tokenization, which prevents the merchant (or anyone who has hacked the merchant) from seeing the card number, but they are not required to do so. I haven't seen any numbers on what fraction of cards use tokenization. Something to keep in mind is that when chip and PIN was developed to combat credit card fraud it was card present fraud that was the big problem, either by someone using the stolen card itself at a brick and mortar merchant or making a counterfeit cart by writing the stolen number onto a blank card and using that at a brick and mortar merchant. Card not present fraud, where the number is used but not a card such as at an online merchant or a mail order merchant or telephone order merchant, was much less common. Chip and pin made card present fraud much harder because it was much harder to obtain blank chip cards and the equipment to write a stolen number to them, and it made using an actual stolen card harder because of the PIN.
        • cm2187 10y ago
          Chip and pin is not for online transactions, but in-store transactions. The merchant can see your credit card and would often manipulate it themselves.
      • stfnfhrmnn 10y ago
        I also use a Unique-per-service email address with Paypal, and I noticed that Paypal actually passes on that email address to the retailer when I pay with Paypal. I receive order confirmation emails (from those retailers) and quite a few unwanted newsletters to my unique paypal address now. I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data. I always have to enter a separate email address with the retailer anyway, and because of this scheme, those two of course never match.
        • syshum 10y ago
          >>>I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data. For years the Paypal API sucked, and even today their are many companies that do not have full integration with paypal, so this is a way to match payment records as for 99% of shoppers the email address for the order/account will match the paypal email address.
        • throwanem 10y ago
          Paypal is great at that kind of unintentional disclosure. Six or eight years back, because I liked what she had to say, I used it to donate to someone who was then speaking under a pseudonym as a result of some fairly credible threats. Imagine my surprise when, in the process of transferring funds, Paypal showed me her full legal name and domicile address in the UI! Of course I let her know about it, and I seem to recall her saying she'd addressed it successfully, but if she described how, I no longer remember. It quite astonished me that this was even a thing that could happen, though. One hopes it no longer does.
          • ramblerman 10y ago
            This sounds like she just set up her full name and address with paypal. It's like her giving out her email address and it being firstname.lastname@gmail.com I'm not sure the fault lies with the service.
            • throwanem 10y ago
  • znebby 10y ago
    For credit cards, check out privacy.com I recently started using it, works great.
    • crypt1d 10y ago
      This looks pretty cool, but seems like they are invite-only for now... Any chance you can drop an invite for a fellow HNer? :)
      • jontas 10y ago
        I've got an invite, contact me via the email in my HN profile and I'll send it over.
        • crypt1d 10y ago
          I just checked their sign up page, turns out they are only available in the US for now :( But thanks anyway!
      • znebby 10y ago
        I found an early access code on their twitter: "NETTED". They posted that 1st August, so I'm not sure if it still works, but give it a shot!
    • ruraljuror 10y ago
      Nifty. Discover Card offers this--or at least did when I was using it.
      • nommm-nommm 10y ago
        They got rid of it.
    • tmd83 10y ago
      Wondering how this works. If one is using different number per transaction where they are getting so many free numbers?
  • raverbashing 10y ago
    Is there a service (email host) that can give you "infinite email aliases"? (Yes, I know about the '+' in gmail, but I suspect the word is out on it)
    • ikeboy 10y ago
      https://dnt.abine.com/ https://dnt.abine.com/
    • MandieD 10y ago
      A Small Orange does this cheerfully, even for the smallest shared hosting plan. You can then go into cPanel to configure a catch-all account for the domain you're using. Biggest downside to ASO: you have to pay $7/yr extra on domain registrations to make them private. So I register with Hover and host with ASO.
    • ryanplant-au 10y ago
      I use Google Apps for Work on my domain, which lets me forward all email to any address on that domain to my inbox. That way I can use adobe@ryanplant.net, github@ryanplant.net, fitbit@ryanplant.net, etc.
      • samch 10y ago
        I do this exact same trick and have been using it for years. It led to a couple of brief and somewhat awkward phone calls with local business owners when I asked them rather pointedly about them sharing my information with third parties. I also take this one step further and have inbox rules to automatically send all promotional email (from sites I'm interested in) to the trash folder. If I want a coupon for a website I frequent, I'll just search my trash for the latest offers from that company. Google conveniently purges messages from the trash folder every 30 days or so, and I don't have to worry about a massive backlog of promos.
    • qznc 10y ago
      The problem is, I have yet to someone who accepts '+' in email address.
    • 10y ago
  • Spooky23 10y ago
    Re: credit cards, unless you insist on using debit cards for some reason, who cares if they are compromised. If someone steals my credit card, AMEX has a problem. I'll take reasonable care, but I'm not going to generate transaction specific numbers or whatever unless there is a strong incentive to do so.
    • _asummers 10y ago
      I wish that it was much easier to generate temporary credit card numbers for all transactions. Like upon entering real number it would generate one and swap it for you.
      • mi100hael 10y ago
        I believe that's pretty much what Apple Pay and the like do.
        • nommm-nommm 10y ago
          Correct. My android pay says "a virtual number ending in xxxx was used to make this purchase." It would be nice if it was a token instead of an actual credit card number. I have no idea how is implemented.
      • feklar 10y ago
        Many had this feature (and Paypal for a while) but dropped it for some reason. My guess is they want to encourage subscription/repeat billing or some kind of fraud was rampant generating temporary numbers.
    • krupan 10y ago
      and AMEX passes the cost of that problem to all AMEX customers. You are still paying for it in the end.
      • willstrafach 10y ago
        how so? when a card is fraudulently used to make purchases, AmEx is not refunding you from their own pockets. they take back the money from the merchant it was fraudulently spent with (a chargeback). no loss at all on their side.
  • krupan 10y ago
    "a unique authorization code specific to this vendor or this transaction and useless to any other actor" Sounds a lot like a bitcoin address.
    • rspeer 10y ago
      ...except not traceable, works with people's payment systems, sends actual US dollars, and doesn't have a 5% chance of getting stolen.
      • krupan 10y ago
        That's an amazing system you just invented, I wish it existed :-)
        • rspeer 10y ago
          Fine, "not traceable by arbitrary people on the Internet". I know the credit card company and everyone they share your data with can see your transactions, and that's a problem some may wish to avoid, but that is still a much smaller number of people who can see your transactions than Bitcoin. Bitcoin does not inherently include privacy.
  • krstck 10y ago
    I wish phone numbers could work this way. When my personal data gets leaked or sold, just revoke access to that particular token.
• CookieMon 10y ago
  > Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks of SMTP routes are breached and picking up confirmation emails, or there's a giant iceberg of pwnage floating beneath the surface out of view.
  • jmknoll 10y ago
    > giant iceberg of pwnage floating beneath the surface out of view Very poetic. I'd like to see this made into one of those motivational posters and hung in the office of every dev team nationwide.
    • iamdave 10y ago
      The tip would be labelled "User Config", while the remaining behemoth, respectively: "DNS". For the sysadmins out there ;)
  • Syzygies 10y ago
    I used to use unique middle addresses for magazine subscriptions, back when magazines were physical. I'd get credit offers with middle name "Byte". Consumer Reports used to include a false advertising hall of shame; I loved sending them an example sent to middle name "CR". They didn't use it, or even answer.
  • bo1024 10y ago
    Or these places sell / give away your email address?
  • freshflowers 10y ago
    > it taught me everything is breached More likely, sold. Every service that collects user data will get offers, and many can't resist the temptation. Doesn't matter however, businesses that will sell you to the highest bidder (and in many cases, outside the US, illegally) can't be trusted to ever seriously invest in security. So if they aren't breached, they sooner or later will be.
• Sephr 10y ago
  I've been using unique-per-service email addresses quite a while, and I maintain a list[1] of all offenders that have leaked my PII. 1. https://gist.github.com/eligrey/5084991 https://gist.github.com/eligrey/5084991
  • flushandforget 10y ago
    Good idea.
  • berlam 10y ago
    I also actively watch my unique-per-service email addresses but have not started with a list, yet. Might be a good idea.
  • neogodless 10y ago
    That's a much smaller list than I expected. I don't differentiate between those that sold and those that ignore unsubscribe (and a few that just have very contrived unsubscribe systems), but I have over a hundred per-service emails attached to disabled accounts (as aliases) to block them forever. One that stands out in my head is Cadillac. I had requested a brochure for a CTS, and I got random unrelated spam just days later!
• Neil44 10y ago
  My LogMeIn unique address gets tons of spam - their response was that I must have given it away elsewhere. I no longer use LogMeIn.
  • Jaruzel 10y ago
    Same here. I have (at the last count) over 200 website/service specific email aliases. I very rarely use an alias for more than one service. However when I do start getting spam on that alias, and I contact the website concerned they always state it's my fault. My response? If I can, I stop using that website or service. My dropbox alias email started getting loads of spam about 2 years ago, I immediately junked that account, and set-up a new dropbox account (friends insist on sharing stuff over it...) - my old spammy dropbox alias is in the Dropbox leaked dump, my new current one isn't, which proves that this dump of credentials is from at least before 2015.
    • Drdrdrq 10y ago
      Is it necessarily service's fault? Could the e-mail address have been intercepted when some confirmation e-mail was being delivered? Not likely, I agree, but still...
• prof_hobart 10y ago
  I do the same, but some companies don't seem to be interested. I've had two different emails linked to a magazine's website and had spam to both. When I've contacted them about it, they've been absolutely adamant that the spammer must have (twice) guessed the exact email address that I've had there.
  • oliwarner 10y ago
    You should report them to their country's data protection body. They are either maliciously selling your data against your explicit wishes or they've been hacked and are ignoring it.
  • 0x0 10y ago
    I've had the same response. When I ask how come the spammer managed to successfully guess exactly the particular unique email address (including unique hashes appended to the service name as part of the username side of the address) on the first and only attempt (verified by looking at mail server logs), they just shrug.
• terraforming 10y ago
  I use spamgourmet.com for the unique-email-per-service.. Sadly, it doesn't support 2FA.
• pingec 10y ago
  Would be cool to have a service do this automatically and test which services leak email addresses and which don't.
• dvcrn 10y ago
  unique-per-service email addresses sound indeed interesting. How did you set it up? I am a google apps customer and already have a few 20 aliases in there but having to go through their UI every time I sign up seems very tiresome. Can I create a wildcard email in the terms of service-*@bar.com being a alias of email foo@bar.com? Do you know of a non-selfhosted provider that is able to do that? /EDIT: Looks like fastmail, a service many on HN recommended is able to do something similar [0], though if one email gets added into a spam list, it seems to be not possible to remove one particular one. /EDIT2: Fastmail just confirmed to be on Twitter that it is possible to set individual emails to rejected. Though this requires effectively creating a new alias and setting it to bounce which falls under the account limitations [1], so 600 for a single person account. [0]: https://www.fastmail.com/help/receive/alias-catchall.html https://www.fastmail.com/help/receive/alias-catchall.html [1]: https://www.fastmail.com/help/account/limits.html https://www.fastmail.com/help/account/limits.html
  • richardw 10y ago
    In Gmail and Apps you can add a +suffix, e.g. dvcrn+hn1@gmail.com will send you mail, assuming your main address is dvcrn@gmail.com. Gmail also ignores full stops, so you could also use d.v.crn@gmail or dvc.rn@gmail etc.
  • alnorth 10y ago
    With Google Mail (and Apps) anything after a + in the first part of the address is ignored, so foo+dropbox@gmail.com would be routed to foo@gmail.com. That's the easiest way to do it that I know of. No need for managing separate aliases.
    • dvcrn 10y ago
      A lot of website purposely remove the part after the plus to avoid multiple sign ups with the same email, but different label. Plus you can't completely shut down a label. You could route it into the trash but it will still end up in your email account.
    • _puk 10y ago
      Whilst great info, unfortunately most of the sites that one would actually try to use this on don't accept addresses containing a "+" as valid. Another Google Mail trick is to use periods. Not as useful as the +, but for those sites that don't accept +, one can usually add in a few extra periods to place sites into buckets (multiple adjacent periods don't work). m.y.e.m.a.i.l@example.com
• dgoldstein 10y ago
  Yes but at the time, there was only evidence of password reuse leading to some comprised email lists... Not that password hashes themselves had been stolen. Sigh.
• OJFord 10y ago
  > Unique-per-service email addresses work pretty well and they're so easy with Gmail - anything following a '+' character after your username (or alias, if using your own/company domain) will go to the same box, but keep the distinct address. Unfortunately, depressingly many sites validate email fields, and get it wrong - thinking '+' is not allowed. IMO it's not even worth trying to get an email regex (or other validation) right - you're probably going to send out an activation email anyway!
  • midgetjones 10y ago
    I'm pretty sure they do know a `+` is allowed...
    • rnbrady 10y ago
      I've had sites reject an email containing +.
      • FungalRaincloud 10y ago
        The trouble is that no one actually implements the email standard from the IETF RFC documents. In fact, some people[0] even actively discourage doing so, despite there being little in the way of good reason to not. The argument essentially goes "well, users aren't going to be likely to use those characters, unless they're doing something bad, and they make it difficult to insert the email into the database." I feel like that's a kind of laziness - we can fairly effectively remove that risk, and there are well tested tools to do so. But I do suspect that forbidding '+' is explicitly to avoid people using tagged emails. To be honest, the inconsistency in services allowing me to use '+' has caused me to just create a separate email for services that I don't have high trust for. Now no one gets my personal email, and I only check that one if I'm expecting something important. [0] http://girders.org/blog/2013/01/31/dont-rfc-validate-email-addresses/ http://girders.org/blog/2013/01/31/dont-rfc-validate-email-a...
        • pfooti 10y ago
          Email RFC is weird. Did you know email addresses are supposed to be case sensitive? Like bob@ and Bob@ are two different addresses? Some services treat them this way, most don't. That intersection (oauth2 for example from Google can return Bob.Smith@domain.com if Bob has a GA4W account, which causes trouble when the oauth handler inconsistently lower-casifies input.
• mike-cardwell 10y ago
  I do the unique address thing, but I also have another system for giving out temporary email addresses. If I want to hand an email address which I know should not receive email after say, this Saturday, I'll just give them "2016-09-03@tmp.grepular.com" - I don't have to do anything to set that up, it will accept mail as long as the date isn't after 3rd September 2016. I blogged it up a while ago here: https://grepular.com/Automatically_Expiring_Email_Addresses https://grepular.com/Automatically_Expiring_Email_Addresses
  • Esau 10y ago
    Interesting. I've been considering doing this but, frankly, have been too lazy to implement it. But if you are using a password manager anyway, what's one more field?
• lnrdgmz 10y ago
  > On a side note, don't forget the time dropbox accepted ANY password during logins - http://www.cnet.com/news/dropbox-confirms-security-glitch-no-password-required/ http://www.cnet.com/news/dropbox-confirms-security-glitch-no... I've not forgotten, and this glitch has kept me from ever considering opening a Dropbox account. I'm surprised everyone else seems so forgiving of this massive screw up.
  • odbol_ 10y ago
    Haha for me it's the opposite. My password never works in Dropbox. I think it's because they don't support spaces in passwords, but they don't tell you when you change your password. They just accept the change and then you can't login.
    • cookiecaper 10y ago
      There are many sites with little exceptions like that. I think that their password filter allows the characters, but their backend input sanitization doesn't, so it cleans it up and inserts a transformed version of the pass without providing notification. I've found this happens particularly often with passwords with symbols like !, #, or ;.
      • zodPod 10y ago
        In general, this is one of the most frustrating things with trying to secure yourself online. I have gone through like "I WANT TO USE PASSPHRASES" then gone to places like PAYPAL and had them have an upper limit on password length. It's absurd that they all have slightly different requirements. I am switching to a password manager now.
      • chebucto 10y ago
        This problem has been noted for some time. Past articles on the subject have shown how the various requirements for passwords come about through a combination of limitations imposed by the system they're being used on, or through misguided attempts at making things easier for users. I wonder if there has ever been an attempt through a forum like RFCs or ISO to define a worldwide (or at least latin char set) standard for password requirements. Based on what i've seen in forums like this, there seems to be fairly broad acceptance that allowing a large number of characters from a character set with as few limitations as possible bests serves the interest of security. The thorniest issue would likely be about balancing requirements for increased complexity (eg capitals and lowercase, numbers, etc) with ease of use.