Hacker News Reader

Comment by anitil | Hacker News Reader

As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.

View on HN

You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.

Yes. Those forms are also ignoring relevant RFCs.

Can you be more specific?

Many sites reject valid email addresses. One character it is common for forms to reject is a "+" in the left hand side of an email address. The email RFCs allow this character, so denying it is bogus. Nevertheless, they do.

https://tools.ietf.org/html/rfc2822#section-3.4

atext = ALPHA / DIGIT / ; Any character except controls, "!" / "#" / ; SP, and specials. "$" / "%" / ; Used for atoms "&" / "'" / " * " / "+" / "-" / "/" / "=" / "?" / "^" / "_" / "`" / "{" / "|" / "}" / "~"

atom = [CFWS] 1 * atext [CFWS]

dot-atom = [CFWS] dot-atom-text [CFWS]

dot-atom-text = 1 * atext * ("." 1 * atext)

...

addr-spec = local-part "@" domain

local-part = dot-atom / quoted-string / obs-local-part

I use a catchall address on my own domain name, and use sitename@domain.com to sign up for everything.

You should be using your own domain for email anyway

> You should be using your own domain for email anyway

Why?

I trust Google to secure gmail.com better than I can secure my own domain.

(a) Using your own domain doesn't require using your own mail server, you can point your mx server at Google apps if you're comfortable or your registrar probably supports mail forward if you don't want to pay for G Suite. (B) it means you can keep your email address if you ever leave Gmail.

I understand that, but there's still the possibility of the domain name itself being hijacked, or even just forgetting to renew it.

Maybe I'm paranoid :)

People have had their Google accounts suspended (especially if it's associated to say, a YouTube or AdWords account), and now you have no access to your address anymore, and Googles free tier support won't help you.

With domains there's an ICANN process to get your domain back if it gets hijacked.

I achieve the same thing by just accepting wildcard addresses at my domain and using sitename@mydomain.com whenever I sign up for things.

Don't any half decent sites strip that out anyways? Some ecommerce sites have actually failed to accept that string, inadvertently thinking it's invalid. The rest, or any marketing CMS, would simply remove it.

Why would you modify valid user input?

This is why I configured my dovecot instance to use - instead of + for the mailbox delimeter

While Troy doesn't directly reveal the breaches, it is pretty easy to deduce which public leaks were part of v1 - especially once they're cracked:

https://cynosureprime.blogspot.com/2017/08/320-million-hashe...

I anticipate similar results for v2.

How does he get hold of the data in the first place?

not sure what his methods are, but you can find torrents of most of the dumps

A combination of public leaks and private contributions. He does a pretty good job of vetting them and determining what era they're from (by polling some users to see when that password was used/changed on that service, etc.)

Reply on news.ycombinator.com