undefined | Better HN

0 pointshalfcat5mo ago0 comments

There’s an attack where you get signed up for mass marketing emails and your mailbox gets flooded with emails from mostly legitimate companies.

Say someone gets into an account you use to purchase stuff (Amazon, etc), but they don’t have access to your email account. They sign you up for this mail flood, then start buying stuff with your Amazon account, and legitimate notifications of purchases are lost in the noise with many thousands of emails from everything from Apple to Chuck’s Boat Rentals.

Using a unique and unguessable email lowers the chances of a more important account being affected (obviously at some point we’re splitting hairs).

0 comments

commandersaki5mo ago

I'm missing what purpose the high entropy alias does; from your description the attacker knows the email address and can still sign you up for mail flood?

catgirlinspace5mo ago

I think the idea is your mail server is set to only accept emails to account names you’ve generated instead of being a catch all. So if one of the ones you generated is used for spam, you could just deactivate that one and move the service that email was associated with to a new generated email. and because there’s no catch all, an attacker can’t just sign up literallyanythingrandom@example.com with dozens or hundreds of different emails.

j / k navigate · click thread line to collapse