3 ms·

If you're being proactive about it, one approach is to create "canary" accounts: single purpose email addresses that signup for your service and nothing else.

If you're being proactive about it, one approach is to create "canary" accounts: single purpose email addresses that signup for your service and nothing else. When those email addresses start getting spam, it's a strong indicator your database has been accessed. Many users signup for each online service with a single-purpose email address. e.g. <servicename>@uniquedomain.com, so many customers will often know of a leak as soon as the service provider does.

grzm 10y ago
I hadn't heard of the canary account approach. Nice idea! As for single-purpose email addresses, that only works for cases where the service isn't selling account information, correct?
- cmdrfred 10y ago
  >As for single-purpose email addresses, that only works for cases where the service isn't selling account information, correct? I don't know how you would tell the difference in that case so I assume yes. The way I implement this is I bought an entire domain for spam. I created a catchall account and when I sign up for services I can just punch in hackernews@spam.com for example. All of this filters into a single email account allowing me to retrieve all my password resets and account confirmations. This will weird out some people over the phone: "Yes, it's comcast@spam.com" "Sir, to look up your account I need YOUR email address"
  - pavel_lishin 10y ago
    I do something very similar. I've had a hotel clerk ask me if I worked for them when I told them my name was <hotelchain>@<mydomain>.org
guitarbill 10y ago
You can also do this with Gmail aliases[0]: "For example, messages sent to jane.doe+notes@gmail.com are delivered to jane.doe@gmail.com." Although the number of sites with incorrect email validation (that reject perfectly valid email addresses) is shocking. I do this, and you can then just block the alias if it starts recieving spam. [0] https://support.google.com/mail/answer/12096?hl=en https://support.google.com/mail/answer/12096?hl=en
- shimo5037 10y ago
  While it may have worked in the past (for a while anyway), what exactly prevents spammers from stripping the suffix, given that the functionality has been public knowledge for many years? Best case they'll be lazy and try both with and without, and you'll end up knowing. Blocking the alias cannot possibly have any effect.
  - guitarbill 10y ago
    > Blocking the alias cannot possibly have any effect. Ah, but it does work (for me, twice). Of course spammers could strip the suffix. But since spam is a numbers game, I'm not sure it's worth the effort for them.
- Semaphor 10y ago
  With fastmail you can also use subdomain addressing [0] for those broken sites and to prevent people from filtering (\+[^@]+) to get unmarked addresses. user@sub.domain.tld is handled the same way as user+sub@domain.tld [0] https://www.fastmail.com/help/receive/addressing.html https://www.fastmail.com/help/receive/addressing.html

grzm 10y ago

I hadn't heard of the canary account approach. Nice idea! As for single-purpose email addresses, that only works for cases where the service isn't selling account information, correct?

cmdrfred 10y ago
>As for single-purpose email addresses, that only works for cases where the service isn't selling account information, correct? I don't know how you would tell the difference in that case so I assume yes. The way I implement this is I bought an entire domain for spam. I created a catchall account and when I sign up for services I can just punch in hackernews@spam.com for example. All of this filters into a single email account allowing me to retrieve all my password resets and account confirmations. This will weird out some people over the phone: "Yes, it's comcast@spam.com" "Sir, to look up your account I need YOUR email address"
- pavel_lishin 10y ago
  I do something very similar. I've had a hotel clerk ask me if I worked for them when I told them my name was <hotelchain>@<mydomain>.org

guitarbill 10y ago

You can also do this with Gmail aliases[0]: "For example, messages sent to jane.doe+notes@gmail.com are delivered to jane.doe@gmail.com." Although the number of sites with incorrect email validation (that reject perfectly valid email addresses) is shocking. I do this, and you can then just block the alias if it starts recieving spam. [0] https://support.google.com/mail/answer/12096?hl=en https://support.google.com/mail/answer/12096?hl=en

shimo5037 10y ago
While it may have worked in the past (for a while anyway), what exactly prevents spammers from stripping the suffix, given that the functionality has been public knowledge for many years? Best case they'll be lazy and try both with and without, and you'll end up knowing. Blocking the alias cannot possibly have any effect.
- guitarbill 10y ago
  > Blocking the alias cannot possibly have any effect. Ah, but it does work (for me, twice). Of course spammers could strip the suffix. But since spam is a numbers game, I'm not sure it's worth the effort for them.
Semaphor 10y ago
With fastmail you can also use subdomain addressing [0] for those broken sites and to prevent people from filtering (\+[^@]+) to get unmarked addresses. user@sub.domain.tld is handled the same way as user+sub@domain.tld [0] https://www.fastmail.com/help/receive/addressing.html https://www.fastmail.com/help/receive/addressing.html