Hacker News Reader

Comment by maccard | Hacker News Reader

How many leaks have you found with this approach?

I've been doing the same thing for nearly 20 years. In that time I've helped two site owners identify data breaches they were unaware of. I can also see evidence of several of the compromises identified in the "Have I Been Pwned" data set.

I have been doing the same for ~30 years now, and having an email address that established has its downsides - I’ve lost track of the number of times the trap has sprung. The most-recent was Tesla, though.

I did a lot of work on iCloud’s “Hide My Email”, and I’m involved (the DRI for) quite heavily in other privacy-focused work at iCloud. It’s something I feel strongly about.

Thank you for the service, I'm just surprised AAPL lets you talk about it.

You will notice a complete dearth of detail in the above on anything not already known outside of Apple...

It's generally fine to talk about something already public, and say you worked on it - there are projects that haven't released yet that I've worked on, and I absolutely will not talk about those until they are :)

I just started doing the same (~ a month ago). Within a week of creating an account for bestbuy, I started receiving spam to that address. Do you do anything when you catch someone, or just note it to yourself, block the address, and move on?

The latter, generally.

It's not worth trying to retaliate because these things come from addresses that aren't monitored, for the 99% case...

I do make a point of telling people how shitty the company is though.. Like Tesla for example :)

Not parent, but I'm doing the same thing and I have had 5 leaks out of (currently) 387 accounts over the past 4 years (which is when I started doing this).

Oh and none of the involved entities ever acknowledged the leaks. I'd also be highly interested in the rates other people encounter.

The "leak" could be the company selling their email list, yes?

Or some kind of involuntarily passing on the mail addresses, like a breach of some kind.

Could be. If they sold the email addresses, that is one reason they would not "disclose" it, it was just routine business (and not business they are eager to disclose, although I suppose it's mentioned in some fine print in their privacy statement somewhere, hypothetically, maybe).

I haven’t counted, but have had a similar rate over 10 years.

I've been doing the same over a similar time span. 5 years for me. However, i am yet to find any leaks.

I get a ton of spam, but they ALL are sent to my publicly listed email address in my git commits. I'm seriously considering turning that email into a honey pot.

Surprisingly zero on one domain. Not because it's ineffective, but because it hasn't leaked as far as I can tell.

The other however has leaked, but that's because it's designed to - it's for social media where the email is available for use and has been abused by third parties.

I've been doing this for maybe 10 or 15 years. It has given me evidence of several database breaches (such as Avvo, who still deny it) but as far as selling my data, I think I've only seen that happen with a Kickstarter campaign.

Reply on news.ycombinator.com