4 ms·

Sensitive Info Goes into 'No Reply' Emails Constantly. This Guy Sees It All

46 points by sbulaev 2mo ago

mcc1ane 2mo ago
https://archive.is/xn3gW https://archive.is/xn3gW
sparkling 2mo ago
There was a CCC talk with a similar approach, where researches bought expired government domains and typo / bit flip domains. For example: bund.de is managed by the German Federal Government and they purchased bund.ee, the Estonian TLD, which is both a typo and bit flip and started watching email and DNS requests coming in. German language only unfortunately https://media.ccc.de/v/39c3-verlorene-domains-offene-turen-was-alte-behordendomains-verraten https://media.ccc.de/v/39c3-verlorene-domains-offene-turen-w...
- noman-land 2mo ago
  This was a great one. The bit flipped domains idea is incredible.
  - iberator 2mo ago
    someone once bought dozen of google.com bit flipped domains hehe.
    - georgel 2mo ago
      Circuit City was a popular misspelled domain back in the early 2000s.
throwa356262 2mo ago
Same thing with the example.com domain until RFC 2606 put an end to it.
- zamadatix 2mo ago
  IANA always held the example.com domain, RFC 2606 just formalized it many years later.
telesilla 2mo ago
I have a very early Gmail account I still use which collects an unbelievable amount of other people's emails who cannot be bothered to fill out a form correctly, hotel reservations, insurances. I could cancel them all easily and mess with people but I delete and move on. It's easy to be a bad actor given the conditions that the internet was built on.
Simulacra 2mo ago
Tangently related, but what do you do when you receive other people's email? There're a couple of people with my name, one in Arkansas and another in South Carolina, and I get all sorts of email for them. They include their middle initial, but many people forget to include that middle initial, so I get utility bills, medical records, all kinds of things. Most of the time I delete it, but.. I feel kind of bad
- Arnt 2mo ago
  I suggest writing a rule to send an auto-reply, like this: https://datatracker.ietf.org/doc/draft-ietf-mailmaint-wrong-recipient/ https://datatracker.ietf.org/doc/draft-ietf-mailmaint-wrong-... That document tweaks the unsubscribe to say "unsubscribe because wrong recipient", most parsers won't notice the "because".

46 points by sbulaev 2mo ago

https://archive.is/xn3gW https://archive.is/xn3gW

There was a CCC talk with a similar approach, where researches bought expired government domains and typo / bit flip domains. For example: bund.de is managed by the German Federal Government and they purchased bund.ee, the Estonian TLD, which is both a typo and bit flip and started watching email and DNS requests coming in. German language only unfortunately https://media.ccc.de/v/39c3-verlorene-domains-offene-turen-was-alte-behordendomains-verraten https://media.ccc.de/v/39c3-verlorene-domains-offene-turen-w...

noman-land 2mo ago
This was a great one. The bit flipped domains idea is incredible.
- iberator 2mo ago
  someone once bought dozen of google.com bit flipped domains hehe.
  - georgel 2mo ago
    Circuit City was a popular misspelled domain back in the early 2000s.

throwa356262 2mo ago

Same thing with the example.com domain until RFC 2606 put an end to it.

zamadatix 2mo ago
IANA always held the example.com domain, RFC 2606 just formalized it many years later.

telesilla 2mo ago

I have a very early Gmail account I still use which collects an unbelievable amount of other people's emails who cannot be bothered to fill out a form correctly, hotel reservations, insurances. I could cancel them all easily and mess with people but I delete and move on. It's easy to be a bad actor given the conditions that the internet was built on.

Simulacra 2mo ago

Tangently related, but what do you do when you receive other people's email? There're a couple of people with my name, one in Arkansas and another in South Carolina, and I get all sorts of email for them. They include their middle initial, but many people forget to include that middle initial, so I get utility bills, medical records, all kinds of things. Most of the time I delete it, but.. I feel kind of bad

Arnt 2mo ago
I suggest writing a rule to send an auto-reply, like this: https://datatracker.ietf.org/doc/draft-ietf-mailmaint-wrong-recipient/ https://datatracker.ietf.org/doc/draft-ietf-mailmaint-wrong-... That document tweaks the unsubscribe to say "unsubscribe because wrong recipient", most parsers won't notice the "because".