4 ms·

You’re doing a weird thing (running your own email domain), doing an even weirder thing (using a different address per site), and then doing an even more weirde

by benced 3y ago

You’re doing a weird thing (running your own email domain), doing an even weirder thing (using a different address per site), and then doing an even more weirder thing (scanning your personal domain for breaches) and your supposition is that very specific use case is a cash cow for Troy Hunt? Come on.

Xorakios 3y ago
It is preferred practice, not a weird thing, to have a dedicated domain and a different address per site for anyone involved in online security research.
dotancohen 3y ago
I do the exact same thing. Every site, service, and contact gets a personal something@mydomain email address to reach me.
- cheschire 3y ago
  Somewhere in the distance, the Count from Sesame Street says "TWO... ah ah ah..."
- cqqxo4zV46cp 3y ago
  [flagged]
Sephr 3y ago
I said cash-grab, not cash cow. A cash grab is something that has an unreasonably high profit margin. A cash cow is something that provides a significant portion of an entity's income. I have no idea if HIBP is a cash cow for Troy. It may be, given these prices, but I don't know much about his other sources of income. HIBP didn't start out as a cash-grab, but it is one now. Troy could have chosen to price it reasonably to cover the costs of the service. This pricing is clearly taking advantage of HIBP's popularity as the de-facto breach list site.
- ehhthing 3y ago
  I can't tell whether this is a joke or not. I would bet you that over 99.99 percent of HIBP's users do not pay for the service. Troy's time has value, so working on a service that provides no income is not really something you can expect a person to do. Troy decided to create an enterprise subscription service to get a bit of revenue from something he's created. It's not cheap, but it's not something you're meant to buy unless you're a company looking to monitor your employee email addresses. This service is pretty cheap in that regard, actually. I really do not understand why you feel that you're being ripped off here. This is just a lack of product-user fit, his pricing structure simply doesn't work for you because you use email canaries. But for a company with 100 people, this pricing is entirely reasonable, if not something incredibly cheap. What you're paying for is everyone who doesn't pay for the service, the time he takes to add new breaches to the service and the time he takes to develop the service. Just because their pricing model doesn't fit you doesn't mean it's a cash grab. Is this too hard to understand? EDIT: Also, I assumed this was a common understanding, but product pricing is based on the value it gives to the person buying. For a company of 100 people, do you think paying $160/yr is worth breach monitoring? I think for any IT department, this would be a no-brainer.
  - Sephr 3y ago
    The cost of this service doesn't scale with number of 'breached accounts per domain'. Ideally, Troy should charge per domain and only choose a modest profit margin.
rkagerer 3y ago
doing an even weirder thing (using a different address per site) It should actually be considered best practice.
- tptacek 3y ago
  It is not.
  - Sephr 3y ago
    Not yet. Best practices can change.
    - tptacek 3y ago
      Best practices have two attributes, both of which represent consensus among practitioners in the field: that it produces an optimal outcome, and that it can reasonably be broadly adopted. Email canaries clearly flunk the second test.
      - Sephr 3y ago
        It seems like Apple iCloud Private Email Relay may be Apple's own stealth way to introduce similar functionality, albeit with the useful spam/leakage data only available to Apple in this case.
      - blueflow 3y ago
        What is preventing you from from adoption?
_lvbh 3y ago
I do the exact same thing minus the breach scanning. It’s not uncommon.

by benced 3y ago

Xorakios 3y ago

It is preferred practice, not a weird thing, to have a dedicated domain and a different address per site for anyone involved in online security research.

dotancohen 3y ago

I do the exact same thing. Every site, service, and contact gets a personal something@mydomain email address to reach me.

cheschire 3y ago
Somewhere in the distance, the Count from Sesame Street says "TWO... ah ah ah..."
cqqxo4zV46cp 3y ago
[flagged]

Sephr 3y ago

I said cash-grab, not cash cow. A cash grab is something that has an unreasonably high profit margin. A cash cow is something that provides a significant portion of an entity's income. I have no idea if HIBP is a cash cow for Troy. It may be, given these prices, but I don't know much about his other sources of income. HIBP didn't start out as a cash-grab, but it is one now. Troy could have chosen to price it reasonably to cover the costs of the service. This pricing is clearly taking advantage of HIBP's popularity as the de-facto breach list site.

ehhthing 3y ago
I can't tell whether this is a joke or not. I would bet you that over 99.99 percent of HIBP's users do not pay for the service. Troy's time has value, so working on a service that provides no income is not really something you can expect a person to do. Troy decided to create an enterprise subscription service to get a bit of revenue from something he's created. It's not cheap, but it's not something you're meant to buy unless you're a company looking to monitor your employee email addresses. This service is pretty cheap in that regard, actually. I really do not understand why you feel that you're being ripped off here. This is just a lack of product-user fit, his pricing structure simply doesn't work for you because you use email canaries. But for a company with 100 people, this pricing is entirely reasonable, if not something incredibly cheap. What you're paying for is everyone who doesn't pay for the service, the time he takes to add new breaches to the service and the time he takes to develop the service. Just because their pricing model doesn't fit you doesn't mean it's a cash grab. Is this too hard to understand? EDIT: Also, I assumed this was a common understanding, but product pricing is based on the value it gives to the person buying. For a company of 100 people, do you think paying $160/yr is worth breach monitoring? I think for any IT department, this would be a no-brainer.
- Sephr 3y ago
  The cost of this service doesn't scale with number of 'breached accounts per domain'. Ideally, Troy should charge per domain and only choose a modest profit margin.

rkagerer 3y ago

doing an even weirder thing (using a different address per site) It should actually be considered best practice.

tptacek 3y ago
It is not.
- Sephr 3y ago
  Not yet. Best practices can change.
  - tptacek 3y ago
    Best practices have two attributes, both of which represent consensus among practitioners in the field: that it produces an optimal outcome, and that it can reasonably be broadly adopted. Email canaries clearly flunk the second test.
    - Sephr 3y ago
      It seems like Apple iCloud Private Email Relay may be Apple's own stealth way to introduce similar functionality, albeit with the useful spam/leakage data only available to Apple in this case.
    - blueflow 3y ago
      What is preventing you from from adoption?

_lvbh 3y ago

I do the exact same thing minus the breach scanning. It’s not uncommon.