Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

3 billion - we live in an age where half the population of the earth can exist on a service, and everyone is vulnerable.

Yes, a good chunk of these are probably duplicates for business / spam / anon accounts, but this is where the world is trending. How long is it until facebook or google have a massive breach?



If that's the case, I think the bigger news then is that yahoo actually had 3B users!


How much of a rounding error can there be when they say "3 billion" instead of "y'know what, it was all of them"?


My Fermi estimation puts it at 10bn users


Nobody ever said they are active users or unique individuals. I know for example I personally created hundreds of accounts on Yahoo! over the years.


Why make hundreds of accounts?


To troll hundreds of different niche internet groups of course.


waayyyy back in the days, like 2002, Yahoo Pool was pretty big and people used bots to make many many accounts that played with themselves (in something like pyramid structure) to boost accounts score. They were usually used with proxies to avoid yahoo protections. I don't remember if i did it, but I knew how to do it. There were also 2 big auto-aimers, hell they were fun and tourneys were fun too :)


Test accounts.


+1. I did the same. At the time I had to do this (around 2015), Yahoo was the least concerned about identifying duplicate accounts. I was testing for an actual paying job, not some side interest investigation, mind you. Some of the services I had to test were clever enough to reject fakeinbox accounts so I used Yahoo.


> I was testing for an actual paying job, not some side interest investigation

What difference would it make?

Do you mean to imply that creating test accounts is a little bit "wrong", and would be wrong for an individual to do at home, but it's OK to do it if someone else is paying you for it?

If so, I disagree on both counts: it's not wrong to create test accounts, but if it was, it would still be wrong even if someone is paying you to do it.


Hmm just a detail I thought to add, not trying to imply anything about the morality of it.


We've created a catch-all *@test.company.com with AWS SES & Lambda, all forwarded to a single test@company.com (a GApps group where the QA staff had access). Took a few tries to get right, but worked flawlessly from then on, saving testers' time every single day.


Russians.


I worked with someone at yahoo that had a name very similar to your handle. He'd have reason to create 100s of accounts.


That’s probably me ;)


Hundreds? Are you sure?


I know a guy who uses a service that creates a unique email account for every service he signs up for. That way, he tells me, if he ever gets any spam, he can delete the account and it doesn't affect any of his other email accounts.


This can be done easily if you own a domain and use a service that lets you specify a catch-all address. I do this with my own domain and G Suite. Then, you don't even need to do any preparation before giving out the address.

It does sound weird to the person writing it down and I've had more than one person say something like "well, if you're just going to give me a fake address, then don't bother" before I explained myself.

One other down side is that it is not as easy to reply to mail as the other, generated identity (in gsuite, you need to create a new account in the domain to write as that username and also maybe jump through a hoop or two). Replying casually can often reveal your main identity, which is often the one you are trying to strongly protect.


Go into Gmail settings and add aliases there for each “account” you want to add to the catch-all. Actual separate accounts costs you $5+/month each.

(I do similar on my domains and the Gmail alias is easier to do than logging into Admin CP and adding aliases there)


+1. I also use *@mydomain.com feature in G Suite, and it's very convenient to understand which companies sell/pass email databases to others w/o my permission. In some cases, you need to reply from that "aliased" address -- in this case, I do go to the Settings, add an alias, got a confirmation code, and confirm it. Then this new "address" is available in GMail in drop-down "From:" menu when you write a new email.

username+anything@mydomain.com is also a useful feature (as well as u.s.er.nam.e@mydomain.com – dots are all ignored in GMail; some services don't allow "+" in email address field, so you can use finite number of variants with ".").

These little tricks make GMail convenient for geeks :)


Thunderbird has the virtual identity plugin for this.


With gmail, you don't need it - foo+bar@gmail.com will end up as foo@gmail.com and you can filter by To: header.


I’ve run a fair amount of email campaigns where we strip out the + if gmail is the domain to ensure it doesn’t end up in some weird filter.

Dick move, I know. Tell marketing that though.

I personally use gmail through a vanity domain and have a catch all rule, so I end up signing up with a fake email account for every domain (hn@mydomain.com) and then the catch all forwards it to my real account (me@mydomain.com).


> I’ve run a fair amount of email campaigns where we strip out the + if gmail is the domain to ensure it doesn’t end up in some weird filter.

At which point you should wind up in the "how widely can I advertise that you're a spammer and all your outbound email should all be routed straight to /dev/null for sending mail to an email address you were never given" filter.


I think that marking the mail as spam sends a signal to their email provider, putting a mark on their account?


Depends on your isp and which email provider they use. The big marketing email services generally do have the feedback loop setup with Gmail though, so yes, you are right.


> I’ve run a fair amount of email campaigns where we strip out the + if gmail is the domain to ensure it doesn’t end up in some weird filter.

Which works, until the Gmail users who bother using + addresses with filters start giving all legitimate senders + addresses and sending everything thst doesn't have one and doesn't come from Google straight to deletion (possibly with a stop by “mark as spam” en route.)


The problem is not all legitimate sites/sources will actually accept '+' as a valid email character even though the RFC says it's a valid email character.


Jinx. :D


Yeah problem with that is the number of crappy regexps sites use that stop you from signing up with a + address in the first place.


Sounds like a great way to get your email marked as spam.


I wonder if it could be argued that this violates anti-spam regulations. Depends on how “plus” addresses get interpreted. Are they a different recipient?


This is pretty useless.

First because it leaks the underlying email (you can safely assume all spammers are well aware of this feature).

Second because if you start receiving spam, you can't stop it. All you can do is to try to deal with the firehose.

A much better solution is randomly generated aliases that you can delete.


It really baffles me that people are still suggesting this as advice for spam reduction. All it takes is a third of a brain and a couple seconds of thought to realize that spammers know this is a thing and can adapt.


They can, but in practice, they don't.


> They can, but in practice, they don't.

And you're confident of this how? I'm not actually convinced this is true. It's definitely a widespread belief though.


Because I'm using the + thing, and I'm still receiving spam to the +ed addresses.


Weird, I've done that for a long time too and hardly any received spam to those at all. Good to know though, thanks.


Independent of the concept's wisdom or implementation, Yahoo! introduced disposable addresses (originally marketed as 'Address Guard') back in 2003: http://web.archive.org/web/20031023014724/http://biz.yahoo.c...


Spammers will never find a way around this.


Yeah, you do realize spammers know that, too? They will just strip part after the +


Of course I do. But most don't bother, and it still works today.


It also works with foo.bar which is a little harder to filter.


Well, not exactly. That would only work if your address was registered as foobar@gmail.com but not if it was registered as foo@gmail.com. Essentially, periods don't matter in gmail addresses.

Adding a . in between any of the characters (or removing, if you registered the account to have .'s included) will still go to the same email address.

But you can't add .anystring to your address and still receive the message as you can with +anystring.

This always blows the mind of the average gmail user who thinks they registered first.last@gmail.com when they find out that firstlast@gmail.com also works.


And many places block email addresses with pluses in it - for example my insurance company


With gmail, you don't need it - foo+bar@gmail.com will end up as foo@gmail.com and you can filter by To: header.

I’m sure spammers have already figured that out.


Lots of programmers haven't, though.

I get addresses rejected as invalid when signing up for some service at least once a month.


My favorite is one site I encountered that let you create and login with such an email address, but the forgot password form couldn’t handle it and would 500.


I've seen programmers get overruled by "product managers" in regards to handling email as it is intended to be handled.


A lot of services don't allow + in email addresses. With gmail you can also insert a . anywhere you like which works more often. But sometimes, catch all addresses really help to test.


What standard is foo+bar@test.com a part of?


I don't think there's a standard which says that "X+Y delivers to X" - it's a configurable option in exim and you could equally well make it "XqY delivers to X" if you were wilfully perverse.


It was already a known trick to identify sources of spam when I was student (1990-1993).


And spam filters


Yes, positive. They were test accounts, but still in the production namespace.


Search Google for this phrase:

verified Yahoo accounts Fiverr

You'll get a sense for how many people generate these for resale to spammers and other shady purposes.


I'm not being snarky, but do you think they would tell us if they did? We have to assume they are prime targets. They might have slightly better personnel, but is that enough to out do the nefarious and the determined? And can we discount a rouge employee?


Well I would say close to half of those accounts are duplicate - as in not 1 account per person.


I would go further and say 3b is an order of magnitude too large. Bots aside, If there are only 3 accounts per user, our estimate is at 1b. Now, we take into account malicious agents like bots and spammers, easily carrying a bloat factor of 3-5. The closer estimation might be 100s of millions of unique human users, and maybe half of those users actually care.

TLDR+Edit: Didn't see your other post and accidentally straw manned you. Anyway, I agree it's gonna be "a lot lot less" than 3b unique human accounts.


The article mentions this:

> The number of individuals affected by the 2013 attack is smaller than 3 billion, because some people​ have multiple accounts ...


Well 'smaller' and 'close to 50%' will have different effects, and I'm willing to bet that the number of individuals affected will be a lot, lot less than 3bn.


Serious question: at what point do we reach the "everyone is vulnerable so no one is vulnerable"?

EDIT: Or maybe not "no one is "vulnerable", but just that everyone's information is assumed compromised and our current societal infrastructure accounts for it.


The NSA already breached both Google and Yahoo. I can't remember if they got Facebook too, but it wasn't that big back then.


For FB the breach might be the feature?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: