5 ms·

Heh, so out of curiousity, i have a very high confidence that the state of Tennessee leaked a lot of data as well. How i know: - i use fastmail, and use the al

by kop316 8y ago

Heh, so out of curiousity, i have a very high confidence that the state of Tennessee leaked a lot of data as well. How i know: - i use fastmail, and use the alias@myemail.mydomain.com to alias everything. - tennessee has a way to let you remind to renew your plates, so i used licenceplate@myemail.mydomain.com - i got a phishing email licenceplate@myemail.mydomain.com - i contacted them, and the investigator said they allow third parties access, so basically it was too hard to track it down. I really don't know what to do, maybe send it to a newspaper?

ultimoo 8y ago
This is a neat approach. Mind sharing more how you've set it up? I've never used fastmail but looking at their pricing page would `licenceplate@` be an additional user that you have to pay monthly for?
- kop316 8y ago
  Sure! It is actually free with fastmail, and is the equivalent to "myusername+alias@gnail.com". I have a custom domain, so i set my email to firstname@mydomain.com. They allow you to use alias@firstname.mydomain.com to alias to firstname@mydomain.com and you can use as many aliases as you want. That is at no additonal charge. To me, that alone is worth it to use fastmail.
  - rbritton 8y ago
    I do basically the same thing. Their iOS app works exceptionally well for this flow, remembering that the last place I left it was the alias creation form. I can typically do this in 30 seconds. Like the parent, I have name@example.com as the official account email for a single user account. All aliases are alias@example.com.
  - a012 8y ago
    I like Fastmail but they require mobile phone number as your identity is big no to me. Basically you can't have two fastmail accounts on one phone number.
    - calvinmorrison 8y ago
      You can't typically cannot have two trial accounts on one phone number. But you can have as many paid accounts as you like with or without a phone number. source: I work for fastmail.
      - a012 8y ago
        How can one sign up without phone number? It's required as soon as you click Sign up button.
Buttons840 8y ago
I once found a state website exposing info they probably (?) shouldn't have been in some JSON fields. The sensitive data was not shown on the rendered page but it was in the browsers memory all nicely formatted. I thought of reporting it, but thought it was more likely they would try to save face by accusing me of being a hacker because I pressed F12 (and that I might have to fight charges in a far away state), rather than accept their mistake. I chose to stay quiet. I guess I'm not the only one to have faced this dilemma.
- kop316 8y ago
  I did try to use their "fraud waste and abuse" line, thats how i got to an investigator. I just think the report went into the circular filing cabinet.
- AlphaWeaver 8y ago
  A friend was once in a similar situation and reached out to the Electronic Frontier Foundation... She didn't end up taking it very far (for other reasons) but their legal team was interested in at least hearing what she had to say, and potentially connecting her with legal advice if it fell in their scope of work.
- LeftTurnSignal 8y ago
  I found a Windows 2003 server (back in the day) with RDP open directly to it. It wasn't behind much (if any) external firewall. It also wasn't patched, and I got in using some exploit I found within a few mins of googlin. Here it was a citys (pop 2mil+) water system. I didn't need a name or password to it once I got into the server itself. I screenshotted the login, the exploit, their water system (it reminded me of MS Paint, which a lot of those system seem to look like), then created a fresh e-mail using Tor, sent a few e-mails to several e-mail addresses I could find for contacting them, and within a few days it was no longer accessible. For a longer time than I should have, I felt bad for doing it, but at the same time, I doubt they would have done much if I just e-mailed them without showing proof. I never received anything, threats or thanks, in that e-mail account. So hopefully someone appreciated it.

by kop316 8y ago

ultimoo 8y ago

This is a neat approach. Mind sharing more how you've set it up? I've never used fastmail but looking at their pricing page would `licenceplate@` be an additional user that you have to pay monthly for?

kop316 8y ago
Sure! It is actually free with fastmail, and is the equivalent to "myusername+alias@gnail.com". I have a custom domain, so i set my email to firstname@mydomain.com. They allow you to use alias@firstname.mydomain.com to alias to firstname@mydomain.com and you can use as many aliases as you want. That is at no additonal charge. To me, that alone is worth it to use fastmail.
- rbritton 8y ago
  I do basically the same thing. Their iOS app works exceptionally well for this flow, remembering that the last place I left it was the alias creation form. I can typically do this in 30 seconds. Like the parent, I have name@example.com as the official account email for a single user account. All aliases are alias@example.com.
- a012 8y ago
  I like Fastmail but they require mobile phone number as your identity is big no to me. Basically you can't have two fastmail accounts on one phone number.
  - calvinmorrison 8y ago
    You can't typically cannot have two trial accounts on one phone number. But you can have as many paid accounts as you like with or without a phone number. source: I work for fastmail.
    - a012 8y ago
      How can one sign up without phone number? It's required as soon as you click Sign up button.

Buttons840 8y ago

I once found a state website exposing info they probably (?) shouldn't have been in some JSON fields. The sensitive data was not shown on the rendered page but it was in the browsers memory all nicely formatted. I thought of reporting it, but thought it was more likely they would try to save face by accusing me of being a hacker because I pressed F12 (and that I might have to fight charges in a far away state), rather than accept their mistake. I chose to stay quiet. I guess I'm not the only one to have faced this dilemma.

kop316 8y ago
I did try to use their "fraud waste and abuse" line, thats how i got to an investigator. I just think the report went into the circular filing cabinet.
AlphaWeaver 8y ago
A friend was once in a similar situation and reached out to the Electronic Frontier Foundation... She didn't end up taking it very far (for other reasons) but their legal team was interested in at least hearing what she had to say, and potentially connecting her with legal advice if it fell in their scope of work.
LeftTurnSignal 8y ago
I found a Windows 2003 server (back in the day) with RDP open directly to it. It wasn't behind much (if any) external firewall. It also wasn't patched, and I got in using some exploit I found within a few mins of googlin. Here it was a citys (pop 2mil+) water system. I didn't need a name or password to it once I got into the server itself. I screenshotted the login, the exploit, their water system (it reminded me of MS Paint, which a lot of those system seem to look like), then created a fresh e-mail using Tor, sent a few e-mails to several e-mail addresses I could find for contacting them, and within a few days it was no longer accessible. For a longer time than I should have, I felt bad for doing it, but at the same time, I doubt they would have done much if I just e-mailed them without showing proof. I never received anything, threats or thanks, in that e-mail account. So hopefully someone appreciated it.