4 ms·
> The only benefit is that I'm able to tell when companies are breached before wider disclosures because I start getting spam emails sent to thatcompany@. My b
by AdamJacobMuller 4y ago
> The only benefit is that I'm able to tell when companies are breached before wider disclosures because I start getting spam emails sent to thatcompany@.
My big problem is that this is worse than useless.
I started doing unique-address-emails back in probably 2002 or 2003 and did it for around a decade before giving up.
A couple of times per year I would start getting spam or similar on an email address and would know exactly what had been breached and I would try to notify the companies involved. I'd probably spend an hour or two finding emails for key contacts and send a few paragraph email explaining how I knew they were breached etc...
90% of the time I got absolutely no reply whatsoever.
5% of the time I got a pleasant reply and someone said they were already aware or they would look into it.
5% of the time I got confused emails from a non-technical person that didn't understand how their PHP shopping cart software which hadn't been updated in 2 years got hacked, and didn't know what PHP or Linux or anything else was because the neighbor's kid had installed the site one time 2 years ago and now was too busy in college and why are you bothering us about this we have orders to ship!
5% of the time I got incredulous replies from technical people who insisted that I was wrong. That email address must have leaked some other way!
Then there was the last time I ever sent one of these emails. I guess I had found and emailed the owner of a company to email who had then added in his tech person. I explained why I had huge confidence something on their side was breached, but, couldn't explain to them what or how. They eventually got rather hostile about it, first accusing me of extorting them for the information (I never asked for money, but bounties weren't really even a thing back then like they are today). Eventually culminated in them adding in their lawyer with more threats and demands for my full name / address (presumably so they could actually sue me). I ignored them and fortunately the whole thing went away.
That was the last time I sent a report about one of my emails being compromised and shortly thereafter I stopped using tagged addresses entirely.
- gowld 4y agoThe benefit isn't that you can tell the company they were breached. The benefit is that you can tell yourself, friends, and the public.
- AdamJacobMuller 4y agoMeh. Some people might want to be the name-and-shame type, but, that's not me.
- xigoi 4y agoYour percentages don't quite add up…
- AdamJacobMuller 4y agoThere's an additional 5% chance that I did that intentionally to be funny. Does it add up now?
- markdown 4y agoSounds like you were the one who made it worse than useless ie. you gave yourself more work and then resented it.
- AdamJacobMuller 4y agoI suppose. I mostly did it as a fun experiment and stopped when it ceased to be fun. I don't resent it or regret it, I had a lot of fun writing the software which powered it.
- ZetaZero 4y agoAs you found out, it is a waste of time to report the leak. But you can still get all the benefits of nuking that email.
- AdamJacobMuller 4y agoNuking the actual email was of limited benefit over time. For whatever reason I started to get spam on my real non-aliased email address and at that point it was all bets off. Shortly after I gave up on the tagged addresses I just moved to gmail.
- Sylamore 4y agoI've had that happen but I just change the unaliased email, update the catch-all target and block the old unaliased email.
- selcuka 4y ago> I started to get spam on my real non-aliased email address and at that point it was all bets off. Why is that? You can also nuke your non-aliased email address and just update your forwards.
- AdamJacobMuller 4y agoYeah but my non-aliased mail is adam@adam.gs I have no idea how it happened but /shrug I could change it, but, I don't really want to.
- teawrecks 4y agoNo one said you're supposed to contact anyone about the spam. If the problem could be solved on their end, this catch-all/tagging solution wouldn't need to exist in the first place. The assumption is that people can't be trusted with your email address, so you create a way that their incompetence/malice can't hurt you, and then you go about your business. Imagine criticizing helmets because children keep falling off their bikes. Btw 90+5+5+5=105%.
- AdamJacobMuller 4y ago> No one said you're supposed to contact anyone about the spam. Considering that, as far as I knew at the time, nobody was doing this at all, nobody told me any of what I was "supposed" to do. Even if they had told me what i was "supposed" to do, I generally am not good at following directions or doing what i'm supposed to do. > Btw 90+5+5+5=105%. Case in point.
- deleted 4y ago[deleted]
- diggernet 4y agoOne time I made up a new address to use for a SiriusXM signup, and that address got a spam email before the confirmation email. As you can expect, that was filed under "people insisted I was wrong".