4 ms·
I've been doing this for exact 20 years this week. I always use a unique address for each site (pretty easy; I just use a wildcard domain). Pretty much everyth
by guiambros 6y ago
I've been doing this for exact 20 years this week. I always use a unique address for each site (pretty easy; I just use a wildcard domain).
Pretty much everything has been leaked: most retailers, software companies, all phpBB forums, wordpress blogs, Experian, Amazon (3P Sellers, not AMZN itself), Dropbox, LinkedIn. The list goes on and on.
Notable exceptions: Google, Microsoft, Apple, IRS.
These days is a lot harder to see leaks, as most egregious spams get filtered even before it hits your server (I use GSuite).
- pabs3 6y agoA better option than a wildcard domain with spam filtering is a server where there is zero spam filtering and each unique address goes to a unique folder. Then you have much more opportunity to detect leaks to spammers.
- guiambros 6y agoIf your objective is to solely detect leaks, then sure, zero spam filtering is the best option. In my case I'm just trying to live my life in a security conscious way, and detecting breaches is just a byproduct. And of course the easiest option is to drop all that and just following Troy Hunt's HIBP [1]. [1] https://haveibeenpwned.com/ https://haveibeenpwned.com/