How Private Are Sites' Membership Lists?

Slashdot contributor Bennett Haselton has written an essay on a subtle privacy issue affecting many websites (including Slashdot!) He says "Suppose your girlfriend called up Match.com and said, "I think my boyfriend might be cheating on me. His e-mail address is joeblow - at - aol - dot - com. Can you tell me if he's a member?" And Match.com phone support told her, "Why, yes, he is a member. You'd better have a talk with him." After you had gotten over the guilt of getting caught -- I mean, the guilt of cheating -- would you not feel like Match.com had violated your privacy by telling a third party that you were a member?" Keep reading to see what he's getting at and to decide if and when it's a problem.

Something like this is actually possible with quite a few well-known sites -- given a person's e-mail address, it is possible to find out if they have an account with Match.com, PayPal, Netflix, eBay, Amazon, and Google (and, by the way, Slashdot [CT: We'd fix it if I thought it mattered]). For some of those sites, it may even be possible to take a long list of e-mail addresses and use an automated process to find out which of those addresses have accounts with those sites (something I didn't want to risk trying myself, but as a general rule, if you can do it once, you can do it many times, at least if you do it slowly enough). It does not enable the attacker to extract addresses from a site's membership rolls, which is a much more serious type of breach -- in this case, the attacker would have to already know a list of e-mail addresses, and would only be able to find out which of those addresses have accounts with a given service. And it definitely wouldn't enable an attacker to extract more sensitive information like passwords or personal data. But the ability to get a yes/no answer for whether an e-mail address belongs to a member of a given site, should be something that the site designer should take into account. I'm not even saying that it should necessarily be considered a security hole in most cases, just that it should be something that the site designers decide whether or not they want to permit it -- not something that was left in the open accidentally. Representatives from PayPal and Netflix assured me that they knew about the possibility of this attack and had countermeasures to detect it. In the case of Match.com, on the other hand, I would argue it looks like an oversight. For other sites, whether it's a security hole or not depends on your point of view.

There are three main causes for concern with this issue. The first is simple privacy -- for a site like Match.com, a person may not want other people to be able to find out that they're a member. The second is the possibility of making phishing attacks easier. If a phisher sends spam to a huge number of recipients, hoping to trick them into entering their login details on a counterfeit site, then generally their success rate would be proportional to the number of recipients who are members of that site (of which a certain percentage will be duped into entering their login info), but the speed at which the phishing site is shut down would be proportional to the total number of recipients (since any recipient would carry the same likelihood of reporting the phishing site to an ISP and helping to get it shut down). So if the phisher could find out which addresses on their list belong to actual members of a given site, and send mail to just those people, they could get more successful attacks in proportion to the number of e-mails sent. This is especially true of "puddle phishing" attacks, where only a small percentage of recipients are likely to be members of the site being phished. The third possibility is that the data could be valuable to spammers wanting to advertise a competing site -- a spammer advertising a dating site, for example, could get more band for their buck by advertising only to Match.com members. (Maybe even try a hybrid spam-with-just-a-hint-of-phish -- spam that says "Rejected a lot on Match.com?" to make the user think at first that the e-mail really is from Match.com, but then steer them towards a competitor.)

With a build-up like this, the attack is disappointingly simple. (In fact, I listed the possible consequences of the attack first, because otherwise the attack itself is too easy to dismiss.) If you haven't already guessed at least one of these methods, the three easy ways to find out if an e-mail address is associated with an account at a given site, are:

• Try to create a new account with that e-mail address. See if you get an error message saying the address is already associated with an account.
• Log in under an existing account, and try to switch to another e-mail address. See if you get an error message saying the address is already associated with an account.
• Use the forgot-your-password feature to request a password be sent to a given e-mail address. See if you get an error message saying that address is not associated with an account.

Each attack works better if you can avoid triggering an e-mail message sent to the e-mail address in question, whether in a success or failure condition. For example, if the forgot-your-password form only accepts an e-mail address as input, then if the e-mail address you enter really does belong to a member, a password reset e-mail will be sent to that member. That won't prevent you from continuing your attack, but if enough Match.com members get password reset e-mails that they didn't request, some of them will let Match.com know what is going on, and Match.com might find a way to stop the attack in progress. On the other hand, suppose the password-reset form requires an e-mail address and a birthdate, and if you enter an e-mail address without a birthdate, you get one error message telling you that the birthdate was missing, and another error message if the e-mail address you entered is not associated with an account. This avoids triggering an e-mail message to the user in either case, and increases the chance that you can carry on the attack longer without being noticed. And once you've confirmed that someone is a member, this type of password reset form would also let you use trial and error to determine their birthdate as well, something that might make identity theft easier later on. (This, by the way, is exactly how the current Match.com password reset form works. Match.com did not respond to requests for comment.)

With most popular sites that I tested, at least one of the above methods fail, but at least one other method succeeds. On Netflix, for example, the forgot-your-password form requires you to enter a last name and a credit card number, so that form can't be used to find out who is a member. On the new member signup page, though, you can enter an e-mail address and be told whether that e-mail address already belongs to a member. With Match.com, on the other hand, I already mentioned the weakness in the password-reset form, but if I tried to sign up for a new account but I didn't correctly pass the Turing test (reading numbers off a graphic and entering them in a text field), Match.com wouldn't tell me if the e-mail address was associated with an existing account. So that form could not be used to sift through 100,000 addresses and find which ones were Match.com members, but it could be used to find out if an individual person was a subscriber.

There are at least two simple countermeasures to this type of attack. The first is to require a Turing test when a user creates a new account, requests a password reset, or changes their e-mail address on file, and make sure that if the Turing test isn't completed correctly, then no error message is displayed about whether a given e-mail address does or does not exist in the system. This makes it hard for attackers to sift through a mountain of e-mail addresses finding out which ones already belong to accounts, but it still enables someone to check if someone is a member, one person at a time. For sites where that would be a privacy concern (again I'm thinking of Match.com), the other solution is better: send an error message to the e-mail address entered, not displayed to the user in their browser. If you try to sign up as joeblow@aol.com, and that address is already associated with an account, then display the normal message telling the user to check their inbox for confirmation -- but then send them a message saying their address is already in the system. eBay, for example, gets this right on their "forgot your userid" page -- if you enter an e-mail address not associated with an eBay account, it simply says, "eBay just sent your User ID to joeblow@aol.com. Check your email to get your User ID." (On the other hand, eBay's new user signup page lets you check if an e-mail address is assigned to an existing member, without needing to pass a Turing test.)

Netflix, eBay and PayPal also responded to say that they had monitors in place to detect "suspicious" activity, saying that even in cases where the forms did not require a Turing test, they could dynamically detect if someone were using a script to submit the form over and over to harvest data, but they declined to go into more detail. It seems to me this could work for forms that require you to be logged-in, but not for forms that don't. For example, on the Netflix new user page, how would they detect if it's the same person submitting e-mail addresses over and over again? Not by IP address -- you can use Tor and farms of open proxies scattered across the Internet to make it appear as if you're coming from lots of different IP addresses. However, consider the PayPal add-a-new-email-address form. This form does not require a Turing test, and does give you an error message if you try to add an address associated with another account. At first I thought this might be a loophole that an attacker could use to find all the PayPal users in a long list of addresses, but PayPal told me that if you do this enough times under the same account, eventually you will hit a limit where the form starts requiring a Turing test. I never got high enough to hit that limit. However, in this case the "dynamic detection" could actually work -- because you can only perform this action while logged in, and after you hit the limit, to continue testing more addresses would require another PayPal account -- and creating additional throwaway PayPal accounts does require a Turing test for each one. So I'll take their word for it that that attack is blocked, although, it seems to me it would be easier just to require a Turing test on the add-a-new-address page.

On the other hand, perhaps in the case of a site like Netflix, it's not something that users really need to worry about, if the company has no problem with it. Big deal, an attacker can find out whether you're a Netflix user -- but that's not a huge privacy violation, it's not like I shamefully hide those red envelopes under my shirt while I'm scurrying back from the mailbox. Now, a spammer can take a list of addresses and run them through the form to find out who is a Netflix customer, and then spam those users trying to lure them to a competing service -- but that's Netflix's problem, not ours, isn't it? (Well, it's our problem that we get the spam. But without using this attack, the alternative was that the spammer was just going to spam everybody on their list anyway, so by that argument, this attack actually results in less spam all around!)

Except... perhaps an attacker could try the third type of attack, a phishing attack to get people's Netflix usernames and passwords, but not in order to compromise their Netflix account, rather to see if the person has an account with the same password at eBay or PayPal. Perhaps a user would be wary of a PayPal phish since they see so many of them, but they might fall for a Netflix one -- although then the attacker's success would be limited to people who had Netflix and PayPal accounts, and were using the same password for them both...

So it seems to me it's not obvious when this should be considered a problem. (All of the sites mentioned in this article were e-mailed about this issue months ago, and so far none of them considered it a serious enough threat to block all three of the avenues of attack listed above.) If abuse of this type becomes common, perhaps eventually these "queryable membership lists" will come to be considered in the same way as open mail relays -- which were never considered a glaring security hole, but were abused in ways that triggered a shift in people's thinking that got them to be gradually phased out, going from open relays being the default standard up to the early 90's, to the point where many ISPs today prohibit customers from running them. Maybe "queryable membership lists" will start to be abused more, if anti-spam technologies get smart enough that spammers can't send 1 million messages at a time any more and have to limit themselves to, say, 100,000 messages at a time to get through people's filters, so they have to pick which 100,000 of their addresses they could get the most value out of. Or maybe things will go in a completely different direction and this will never become a problem. I just think that, for now, we should be aware that some form of this trick works on the majority of sites that require an account, and the types of abuses described are at least possible.

Comments

Hmmmm

[zoomshorts]

Not in their best interests, but they ARE capitolists.

Re:Hmmmm

[Anonymous Coward]

"Capitolist"? Is that a new term for a politician? You may mean "capitalist".

Answer

[MyLongNickName]

If you are doing something you don't want to get caught for, use a throwaway email address. If you trust a web site to keep your information private, you need a reality check. You can fight the windmills all you want, but they will keep spinning away and ignore you.

Problem solved.

Re:Answer

[fohat]

Exactly. Even better, If you have your own domain name where all email gets delivered to one "catch all" makes it even easier. My friend uses a different email address for each site he signs up for to see who spams him or sells his email out. It's also a good way to know if a site is being honest with any policy where they state they won't do anything with your email address.

Additionally, it is a good idea to not use the exact same username for each site you have to "sign up" for, especially if you are unsure of the sites policies. The main problem for most folks is trying to remember all of this information when they want to log in. I've heard of devices that will help with this but have never tried them.

Re:Answer

[inkedgeek]

Yeah the device that keeps track of all them is called a paper and pencil.

Re:Answer

[Abcd1234]

Exactly. Even better, If you have your own domain name where all email gets delivered to one "catch all" makes it even easier.

Actually, anyone can do this if they have a gmail account. Any address of the form "myaddress+suffix@gmail.com" will be sent to "myaddress@gmail.com". So if you want to see who's sending you spam, just create a new address of that form for each site you register to.

Re:Answer

[networkBoy]

Which is cool till you want to dump +suffix. I mean it's better than nothing for sure but I have a mailserver host with unlimited forwarders and a boatload of real boxes (to a max of a gig of mail). Thus I register sitename(+seq#)@networkboy.net (i.e. slashdot01@networkboy.net) I point the address to my root account (random numbers and letters@networboy.net). If an account goes bad and spammy, and I don't want the service I forward to :blackhole:. if OTOH I think the address is compromised but still want the service I change my e-mail (seq++) and then :blackhole: the old one.

On the surface it seems like a lot of work, but in reality it's dead easy.
-nB

Re:Answer

[nametaken]

This essay seems to be largely about phishing attacks, etc.

What worries me more, is that my mother, who is not my guardian anymore (by a longshot) can still call educational institutions that I attend and get information about my enrollment with nothing more than my name and social security number. She's hardly what anyone would call an expert in social engineering.

Or how about banking? Many banks use your ssn as an identity verification. Both stupid AND dangerous! Somewhere along the line someone decided that the ssn was a secure pin that everyone was guaranteed to have, and was easier than managing your own secret pin system. I'd love to see that person flogged.

Re:Answer

[AVee]

Indeed, and while you're at it, only use this email address outside of your house. Like in internet cafe's and such. You girlfriend might just poke around on your computer. Als make sure she does not follow you when you are going out. Tell you're colleages not to let here in, since she might sneak up on you at work. Or perhaps it's best to just tie her up in the basement, that will solve the issue.

Or maybe, just maybe, we are solving the wrong problem here. Do i really need to explain something is wrong when you have to hide stuff for your SO?

Offcourse there is another problem, your SO is not the only one who has your email address. But do you really think that someone who is checking your email address against various websites to see if you have an account there should be having your email address? Nope, so solve that problem, make sure that people/organisations that cannot be trusted with you email address will not get it.

Re:Answer

[Abcd1234]

If an account goes bad and spammy, and I don't want the service I forward to :blackhole:

You can do the same with gmail. Just create a mail filter on the To: line and instruct it to delete the emails. Easy peasy. And works for those who don't maintain their own email infrastructure.

Re:Answer

[Anonymous Coward]

That fails on some sites that disallow a "+" sign in email addresses even though they are perfectly valid.

Re:Answer

[beckerist]

I do something similar, I use Gmail as my "spam filter." Since they allow forwarding, I use email address A to sign up for all my online crap. I then forward from address A to address B, and change both the "from" and "reply-to" boxes to reflect address A (again, you can do this all in gmail!) I check my email at A once in a while, but mostly it's to delete the hundreds of spam a day I get. If anything sneaks through the filter, I go to address A, find it, tell google it's spam and I won't get another one! I get maybe 1 or 2 spam a day at address B (that I can quickly go and prevent from happening again!)

Re:Answer

[Anonymous Coward]

It's part of the RFC - it was not invented by Google.

I wish people knew what they were talking about.

Re:Answer

[Skye16]

I did that for a very long time, and I stopped purchasing from more than a few sites as a result. However, after a year or two of use, I started to get a handle on who the good guys were, and who the bad guys were. And I started getting those pesky "try everything on a domain" spam sessions where everything from asweriyuherkij2350892wer@domain.tld got through to cxeryhwq3583adf23@domain.tld. Needless to say, that broke my catch all method, which was somewhat similar to a honeypot, but by then i already had a list of trustable online merchants that would give me deals so close to the market minimum that, even if i sometimes overpaid by 2$, at least i knew my email address was safe. I created manual forwards for each of these services, just in case their methods changed overtime, but the catch-all, for me at any rate, has gone the way of the dodo. Still, when I do need to purchase something from a dealer I may not trust, I create a forward for it and go that way. It helps keep me safe.

Re:Answer

[Richthofen80]

What worries me more, is that my mother, who is not my guardian anymore (by a longshot) can still call educational institutions that I attend and get information about my enrollment with nothing more than my name and social security number. She's hardly what anyone would call an expert in social engineering.

Even worse, places of prospective employment can call universities and get information about my enrollment as well (oftentimes without my social security number)! How many times have I lost a potential job from an employer who called a University to find out I never graduated. What a load! they should obviously by law only be allowed to take what I say about it.

Give me a break.

Re:Answer

[mcpkaaos]

Nope, so solve that problem, make sure that people/organisations that cannot be trusted with you email address will not get it.

While I'm at it, I'll solve world hunger by just making sure people have enough to eat.

Re:Answer

[Trillan]

I think the reality is that if you are doing something you don't want your spouse to catch you at, it will affect your relationship in other ways. You'll be too tired when she wants attention, or you'll be angry when she asks an innocent question that you perceive as loaded.

Eventually, she's going to find out anyway. Maybe not today, maybe not tomorrow, but one day.

Better not to keep secrets.

But for general privacy concerns, I think throw-away email addresses are good advice.

Re:Answer

[eneville]

Exactly. Even better, If you have your own domain name where all email gets delivered to one "catch all" makes it even easier. My friend uses a different email address for each site he signs up for to see who spams him or sells his email out. It's also a good way to know if a site is being honest with any policy where they state they won't do anything with your email address.

Additionally, it is a good idea to not use the exact same username for each site you have to "sign up" for, especially if you are unsure of the sites policies. The main problem for most folks is trying to remember all of this information when they want to log in. I've heard of devices that will help with this but have never tried them. oh please, please, for the love of god don't do that to yourself. so much spam is sent to rand()@example.com that this simply isn't feasible these days. it's better to use aliases@example.com than a -default.

Re:Answer

[coinreturn]

Even worse, places of prospective employment can call universities and get information about my enrollment as well (oftentimes without my social security number)! How many times have I lost a potential job from an employer who called a University to find out I never graduated. What a load! they should obviously by law only be allowed to take what I say about it.

OTOH, I know someone who got a college degree by calling colleges until he found someone with the same name who graduated at a time when he was of college age. He even got them to send a duplicate degree to him. He says most people waste four years getting a degree, whereas it took him only two days.

Re:Answer

[illegalcortex]

Must have been tricky getting the matching social security number...

Seriously, I think this would only work for the dumbest employers. But for those employers who are likely to check at all, they'll do something more than just give the name and date of graduation. There were a half-dozen students with my name at the same time I was enrolled.

Re:Answer

[Richthofen80]

Most large employers include it as part of their background check. Once an offer, contingent on verification, is presented, the employer runs a background check via a third party. The third party reports all sorts of info. Sometimes the third party cannot obtain the proper education verification. Happened to me. On my first day of work I had to bring in my Diploma.

Re:Answer

[Achromatic1978]

This is an issue that should be raised. I'd actually wager that most sites that disallow "+" in email addresses do so deliberately, because they know that people doing this are usually hedging against the possibility of their email address being sold. Block the user from doing this so it's an extra step on their part to catch you out if you do sell the address (either by having to manually, except in the case of catchalls, create a new account, or just hoping you'll use your real address).

Essentially, it's a shady practice, if you ask me.

Re:Answer

[Pope]

Nah, Stickies.app works just as well and used recycled electrons!

Re:Answer

[brunascle]

You can fight the windmills all you want, but they will keep spinning away and ignore you.

WINDMILLS DO NOT WORK THAT WAY

Re:Answer

[Anonymous Coward]

It depends on your domain. I've had my domain for several years now doing this exact same thing and get zero random spam. I would imagine that any half decent spammer is aware of the + addressing technique and is quite able to eliminate the +, and send directly to your primary e-mail account. Of course, my domain isn't really used for anything other than e-mail, so it's not likely to get targeted since there isn't really anything there. I get minimal spam anyway, and I use gmail for my domain and it generally gets caught right there.

Re:Answer

[Anonymous Coward]

Or maybe, just maybe, we are solving the wrong problem here. Do i really need to explain something is wrong when you have to hide stuff for your SO?
Do I need to explain that that was only an example?

Nope, so solve that problem, make sure that people/organisations that cannot be trusted with you email address will not get it.
I guess that means no creating an account on... well... anywhere.

Re:Answer

[networkBoy]

Now that I did not know!
I assumed (wrongly, apparently) that the to field was not involved in filtering.
-nB

Re:Answer

[John Courtland]

One caveat, if you're doing something you definitely do not want your name associated with, you probably don't want to be sending email to a domain you purchased, unless you falsified the WHOIS record for your domain.

Re:Answer

[dgatwood]

Better yet, give such an email address to your girlfriend. This serves three purposes:

1. It's an email that only she uses, so you can sort it at top priority in your mail queue.
2. It's an email that only she uses, so she can't use it to find out if you are on any service.
3. It's an email that only she uses, so when you break up, you can delete the email address.

:-D

Besides, this whole question strikes of a very paranoid, insecure girlfriend. Maybe it's a sign that she's not worth holding onto. If I got caught with an account on match.com by a girl who were my girlfriend at the time, my gut reaction would be to ask "What kind of psycho nutjob are you?" followed by "Get the [expletive deleted] out of my house."

Also, an account on Match.com is a really bad example. Having an account doesn't tell you anything except that the person did at one time use said service. Asking if the guy created the account since [date relationship began] would be a more telling sign that the guy was unhappy in the relationship, but still would not be evidence of cheating. Evidence of cheating is... oh, I don't know, some other woman's undergarments under the couch cushion, another woman's hair in the shower drain, another woman's personal articles in the back seat of the car, etc., and even then, those can all be explained in other ways---a prior relationship, a next door neighbor doing bathroom remodeling, and taking your friend's daughter home from school because your friend was too busy/sick/abducted by aliens....

Short of catching the guy out with another woman, all you have is reasonable cause for suspicion, and girls, if you don't trust the guy you're with, you should break up with him. It really doesn't matter if your suspicions are confirmed or not unless you were friends before the relationship and hope to still be afterwards, but in that case, you wouldn't distrust the guy, would you? All that continuing a relationship built upon a lack of trust is going to do is eventually end in a divorce when that lack of trust turns into something nasty, either because you find out the guy really is cheating or because the guy finally gets sick of being treated like a criminal in his own home. Either way, it isn't a healthy relationship, and it is better to just get out the first time you think something might be wrong rather than going around acting like a psycho stalker. Here's a hint: normal guys really DON'T like that.... It's creepy.

The sites where membership would potentially be embarrassing (e.g. Playboy.com) would be expected to have much tighter limits on that sort of information, and would not be expected to give it out without significant proof that you are the account holder. I could be wrong, though. Might be worth testing just to find out. Volunteers?

Re:Answer

[Anonymous Coward]

i can has list?

Re:Answer

[cayenne8]

"Most large employers include it as part of their background check."

Good Lord...unless this is a place requiring a security clearance....I've never heard of an employer requiring a background check?!?!? I mean, do they ask for your SS or something on the application? I've never run into that in my decades of work....at least for non-secure environments. Heck, even at that...I've only ever had to take one piss test ever...and that was just upon intial employment at one place. I mean, I could pass one any day of the week, but, I keep hearing of some many places requiring drug testing, and I've yet to work for any that really did any testing....

Re:Answer

[Mozk]

Well I WAS using joeblow@aol.com, but fuck if I won't get spam now... Thanks a lot Slashdot!

Re:Answer

[butterflysrage]

I too had to bring in a photo copy of my diploma, as well as a copy of my course transcript, the company I work for isn't small either and I graduated in the same city as their primary R&D facility where the majority of their employees work.

Re:Answer

[eneville]

It depends on your domain. I've had my domain for several years now doing this exact same thing and get zero random spam. I would imagine that any half decent spammer is aware of the + addressing technique and is quite able to eliminate the +, and send directly to your primary e-mail account. Of course, my domain isn't really used for anything other than e-mail, so it's not likely to get targeted since there isn't really anything there. I get minimal spam anyway, and I use gmail for my domain and it generally gets caught right there. i dont think that anyone can think like this now, especially if they use a mail list of any volume. i use my mail addresses for work, home, family etc. but the moment one of them gets an address book harvest, then i have to make another address or domain...

Re:Answer

[illegalcortex]

I think you missed my point. I was saying that just finding someone at a college with a matching name isn't going to cut it.

But maybe you meant to reply to coinreturn instead...

Re:Answer

[Anonymous Coward]

What worries me more, is that my mother, who is not my guardian anymore (by a longshot) can still call educational institutions that I attend and get information about my enrollment with nothing more than my name and social security number. She's hardly what anyone would call an expert in social engineering.

Speechless. Totally speechless. If a company I ever dealt with behaved in that manner, I'd make a formal complaint to their regulator, and consult my lawyers about a lawsuit.

Re:Answer

[Penguinisto]

Here's a quickie list of employers who check backgrounds for very legit reasons:

* School Districts (to check for lots of things, from sex offenses to educational background)
* Banks (lots of money in them thar institutions)
* Mortgage/Title/Insurance type companies (and other bonded, notary-public type jobs)
* Civil Service (even w/o the clearance requirement... ferinstance, the quickest way for an ex-convict to clear his own name is to work for the state criminal records department, no?)

I'm sure the list can get much, much longer.

But then, I've been a teacher, worked for a DoD contractor, and have had more fingerprinting and drug testing done than I could ever care to count. *shrug* No biggie...

/P

Re:Answer

[coinreturn]

His employer must not have done a sufficient background check on it because he got the job. In fact the only reason he got the bogus diploma was because the employer said he had to have a degree. Are you saying schools use SSN to match the identity to a name? Strictly speaking, the school cannot use your SSN for such things due to privacy rules surrounding SSN's, though I know they do it all the time. That's why you have student numbers instead of SSN's used by the school.

Re:Answer

[Harik]

Marketers know that user+tag@domain.com = user@domain.com. It's not precicely difficult to undo.

Re:Answer

[illegalcortex]

His employer must not have done a sufficient background check on it because he got the job.

I would strongly suggest his employer did NO background check. That seems to be the norm. There have been plenty of high profile cases where people in prominent positions were found to have lied about their academic credentials for decades.

I simply picked SSN as a secondary identifier. Yes, schools use SSN, even when they aren't supposed to. Back when I went, you had a student ID# that defaulted to your SSN unless you complained and got a random one. You can pick a lot of things. Birthdate is another. In this case, middle name might have sufficed.

Re:Answer

[dwater]

> "myaddress+suffix@gmail.com"

Fastmail.fm also do this. I use it to automatically filter messages into folders.

I still think Fastmail is better than Google mail - I have both but find myself using fastmail much more.

Re:Answer

[Anonymous Coward]

Don't we all?

Re:Answer

[obeythefist]

That is a flawed analogy, there easily exists sufficient explosive devices to destroy each and every windmill that might (for whatever reason) be offensive to you. Inflicting enough structural damage onto a windmill will prevent it from spinning.

Maybe a car analogy would be more appropriate?

Re:Answer

[mountiealpha]

I've run into several sites that refuse any email address in that form (ie, foobar+somesite@gmail.com is rejected). Wish it worked all the time, though!

Re:Answer

[Abcd1234]

Well, that's easy to deal with. Just create a new account dedicated for use on websites. When registering, use the spam account, but attach a tracking suffix. Then forward the mail from the honeypot to your primary, and filter accordingly. At least then you catch the most common case, while dealing with the more intelligent spammers who might strip the suffix.

Of course, if you're really paranoid, you can always create new accounts for each website, and forward as usual.

Re:Answer

[CheShACat]

Password Gorilla!

Doh!

[ReidMaynard]

Sounds like Bennett's wife discovered his match.com account.

Re:Doh!

[snowgirl]

Actually, I got all confused from the title, because I'm like, ok, yeah I would feel guilty for invading his privacy.... wait, cheating? How would I be cheating for invading his privacy? AHH!!!!

Then I realized it's a slashdot article, and thus ignores my gender's existence.

Re:Doh!

[NiteShaed]

Then I realized it's a slashdot article, and thus ignores my gender's existence

Ignore it? Hardly. We obsess over the existence of you gender endlessly. Problem is that we obsess over it in much the way we obsess over dragons, Bigfoot, UFOs, The Loch Ness Monster and other mythical creatures.

Re:Doh!

[Anonymous Coward]

ignores my gender's existence

That's not true. I was just acknowledging your gender's exist last night. Several times in a row. Then in a relaxed moment I realized I was in fact very thankful for your gender's existence.

Unless you're one of those weird people who thinks there are 27 genders and that you are proud to be "gender 23" and basically spew self-important conceited bullshit all the time about how awesome that is. Then yeah, I totally ignore that crap. MALE, FEMALE, or OTHER. That's how I roll.

Re:Doh!

[code_monkey_steve]

Oops, didn't mean to mod you down.

It's a little embarrassing, but honestly, I thought it would mod you "+1, Redundant".

Re:Doh!

[pjp6259]

don't worry. By posting in this discussion, you've undone all moderations in this discussion.

Re:Doh!

[jonaskoelker]

Way off, dude. We know girls exist. What we obsess about is talking to one.

(At least as far as I heard, talking to them is the first step towards getting to have sex with one. Can anyone confirm this?)

*looks through subscriptions*

[Mockylock]

Fuck.

If most spouses were savvy enough to call up sites and ask for information on their significant other, they probably would have caught them previously in some way, shape or form.

Chat logs, history and everything else, show quite a bit of information for any computer-literate person to evaluate.

Not only that, but I'm sure that anyone smart enough to hide everything and cover their trail, wouldn't leave personal information for their spouse to find.

Re:*looks through subscriptions*

[Shakrai]

Not only that, but I'm sure that anyone smart enough to hide everything and cover their trail, wouldn't leave personal information for their spouse to find.

Yeah, there's this really advanced technology, called hotmail, that can be used to obtain an e-mail address your spouse doesn't know about ;)

Re:*looks through subscriptions*

[Mockylock]

Exactly.

Along with thousands of other providers. Not that I would KNOW about any of those situations, but I'm trackin'. *cough*

Re:*looks through subscriptions*

[Nephilium]

Of course... if the relationship is already at the point where they're attempting to secretly investigate each other, it's a dead relationship anyways...

Nephilium

Re:*looks through subscriptions*

[Bucc5062]

People, like programs are not infallible. In an affair, at somepoint the subconscious begins to leaves clues so the affiar can be revealed. Asked someone having an affair if they would confront their sponse directly with the news and the response would be some variation of "Hell No". yet, watch them long enough and slip ups, mistakes in the stories, items left out by accient get more frequent.

A lie is to hard to maintian for a long time. No one is perfect in the cover up.

Re:*looks through subscriptions*

[Mockylock]

To an extent, that's true.

But, even when stress of everyday life hits you, be it children.. work.. school.. household issues and other things that build up, bumps in the road lead to unneeded paranoia in some cases.

Even if it's miscommunication, there are lots of reasons that people take those steps.

My wife and I had arguments over little household spats and daily stress with the kids. Little did I know, post-partum depression can last over a year after having a child. Everything was REALLY fucked up and I couldn't figure out why. I started seeing if she was talking to someone else or something along those lines.

The relationship wasn't "Dead" by any means, but when people are twisted over miscommunication and only have so many places to turn for information, they take different measures for reassurance.

In other thoughts... if you haven't got anything to hide, then you haven't got anything to worry about. So, you're at least half right.

Re:*looks through subscriptions*

[Anonymous Coward]

But you will want to gather as much information about the intentions of your significant other as you can so you can protect yourself, kids, assets, etc. Divorce is not a nice thing to go through, and lack of trust is the primary reason for checking up on someone. Sure the relationship is "over," but the messy details of the breakup probably aren't.

Re:*looks through subscriptions*

[Mockylock]

I'm glad someone thinks the same way I do.

All the little subconsious snippets that we've gathered from other failed relationships, tend to give you that uneasy feeling that something bad is going on. You may not be able to pick out exactly what it was... but it's just the way she's acting (outside of the norm) that makes your mind say, "wait... I know this intuition... and it's not good."

I've been there before and KNOW what you mean. Even when you know the feeling, and you know that something is going on.... they still deny it with no reassurance. One ends up in a downward spiral of disbelief, distrust and lack of confidence.... either way, they'll end up leaving you over: A. Acting paranoid and accusing them of cheating; or B. You letting it go and losing them to what you feared was true (in this case, the intuition of cheating).

But, of course, most women would rather call it rhetoric.. rather than psychology.

Re:*looks through subscriptions*

[networkBoy]

hence the moon landing can't be a fake...

But, you are right, marital infidelity is hard to cover up. My spouse and I have a covenant that should either of us want to stray it's automatically OK so long as neither of us hides it from the other (from family is fine, but not from each other). This has worked out very well as one of us was... interested in another person. This person was known to both of us, and was reciprocal in the interest. Nothing ended up happening, because my wife and I were able to talk about it openly and without fear. Had this been a buried interest I'm willing to bet something would have happened.

-nB

Re:*looks through subscriptions*

[iamacat]

Just curious, if both of you think you might develop enough interest in other people to actually have a fling, why not have a more open relationship that still has boundaries (ok to have a fling, not ok to spend lots of time with other people)?

Re:*looks through subscriptions*

[networkBoy]

That's what it is really, just that openness is requisite. Helps keep things in balance and perspective, plus it gives the spouse a chance to ask why and propose alternatives (or a I don't know, they seem [fill in the blank] to me). So far it's served my marriage very well.

Re:*looks through subscriptions*

[Bucc5062]

"But, of course, most women would rather call it rhetoric.. rather than psychology." Most women would call it our problem to deal with. At times they are worse then debugging an infinite loop that only occurs in a certain moment, but you cannot duplicate that moment ever again. A man who says "I understand her/women" is either a fool, about to be majorly suprised, dead, or gay. These days I would rather be dazed and confused, understanding of "Yes Dear" in it's fullest sense with someone rather then proclaiming my *freedom*, I can play their game while flying solo.

That's a very long article

[Anonymous Coward]

About something that I care not a whit about.

Author: Learn to edit yourself
Editors: Learn not to post crap

Re:anyone here use match.com?

[MyLongNickName]

Personally, I've been using Slashdot to meet my dating needs. Needless to say I have been less than impressed.

need to check the regdate too

[iteyoidar]

I hope you can get the registration date too, what if this person's girlfriend had a match.com account before he met her.

what if they met on match.com. but then she figured out he had two match.com accounts, like a secret one. then he would be cheating on her.

Re:need to check the regdate too

[Anonymous Coward]

What if they both had secret match.com accounts and ended up having an online affair with each other and then set up a 'discreet' meeting and discovered the horror that they had been cheating on each other with the other person.

That might cause a rift in space-time.

Not exactly

[TodMinuit]

If people valued their privacy, it would be in a companies best interest to protect their customers privacy. If a company didn't, people wouldn't use them.

Re:Not exactly

[Zanth_]

This is a completely invalid argument. Many companies realize their customers have no choice (save for litigation up through the supreme court via the clogged arteries of political and bureaucratic mayhem).

Think telecoms. I sign up for a service. I have to give a certain amount of information for service to my home of course as well as billing etc. Said company gets an enticing offer by a few marketing companies for their client list and any semblance of privacy has been taken from us without our consent, or deceptively with it, as consent was granted signing the contract for the service. Said consent was buried deep in the 6pt font on the back of Form B line 492.

How about credit card companies? Or major retail outlets? Many of these places offer reward cards or credit cards and the lists are sold off to other companies to use at their leisure. An old professor of mine used to have a Shopper's Drug Mart Optimum card. Shopper's Drug Mart is a massive chain in Canada (maybe in the US too?). Her son has a very rare disorder that requires a cocktail of drugs supplemented with high amounts of vitamin C. She started receiving snail mail spam regarding fresh fruit direct to her door as well as garbage mail from a competing pharmaceutical company regarding some meds. She only shopped at Shopper's and she always used her optimum points card. Outraged by this, she contacted the company who admitted that they do sell (or did at that time, about 10 years ago) their client lists to some "select and reputable companies."

Yeah sure right. They sell to whoever will pay large. When it comes to customer privacy, so long as the company realizes they have a stranglehold on a market, they can do what they want because either there is no competition, therefore no alternative for the consumer, or that their market dominance is such that even if they do lose a bunch of customers or have to deal with some legal issues, the benefits/profits far outweigh these marginal hiccups.

There are aspects of privacy one should not expect to retain (walking in public and not being noticed, or photographed etc) it is quite a different problem entirely when a company starts selling off or divulging information. Any of these releases of info should be opt-in only. Heck, in a lot of ways I believe a phone book should be the same way vs. paying to opt-out with an unlisted number.

Re:Not exactly

[TodMinuit]

No, it's not an invalid argument. If people did value their privacy enough, I could start a competitor to any business you named, offer the exact same service plus privacy, and people would instantly switch or the other business would fall in line.

Re:Not exactly

[Zanth_]

Good Luck with that. Go out and start a telecommunications company. Go find the venture capital, drop your own copper, your own fiber. Hire the lawyers needed to get the FCC to permit you to jump state borders. Oh, you can't find the 20 billion dollars this will require? But you stated that you could start a company that could offer the exact same service with privacy. No no you can't. This is exactly why these companies continue to exist today. They have bought their security. Laws are in place to protect them.

Now with something like a retail outlet, sure it is possible to overtake them, but if you start something in NYC and I'm in the middle of Arizona, it will take perhaps a decade or more before your mythical company can come and save me from the nasty retail overlords that dominate my realm.

You might be able to help out a few but the many would still be suffering. It will take a massive revolt the likes of the civil war to overturn all the laws that protect these gargantuan companies. So sure, the little companies abusing their customers may fizzle out, but the real abusers, the big bullies will just buy their way out of the mess.

Re:Not exactly

[saider]

You might be able to help out a few but the many would still be suffering.

The journey of a thousand miles begins with a single step.

Re:Not exactly

[cayenne8]

"Heck, in a lot of ways I believe a phone book should be the same way vs. paying to opt-out with an unlisted number."

Well, there is one way to almost get an unlisted number for free. You CAN tell them how you want your number listed. Say your name is Joe Franklin Sixpack. You can tell them you want it listed as J. F. or you can actually slide weird names by them occasionally (they do like to keep in similar to real name). Maybe do your name as J. Franklin, or F.Sixpack, or try to slip one like Francis S.....anyway, you can get away with this...they started doing it I think so single women wouldn't stand out so much in the phone books...but, you can pretty much choose what name is displayed with your name.

When I had a landline, and when I got a call asking for the 'weird name' I had listed in the phone book, I knew immediately that it was a marketer...and just told them wrong number, or that person had died or something....

Re:Not exactly

[crossmr]

even without them saying a weird name I know within their first line if they're a marketer. They're not really that sneaky.

Re:Not exactly

[flynnternet]

I have the land line listed under "my brother's" name (he (who happens to be dead) pays the bill yadda, yadda...)

And it's not like I've given the number out to anyone other than to people that I never want to talk to: Speak to the Machine, Thank You for Playing!

Fsck the 'unlisted' charges, it's not like we don't already pay enough specious Telcom charges (Federal Access Charge @ 6.50/mth?!? WTF... Is this how our Fiscally Responsible(TM) OverDorks pay for the HomeLand '(In)security' NSA monitoring program?).

Man this shite pisses me off....

----------

I'd buy That (sig) for a Dollar...

Seems to me...

[catbutt]

...that if you are that paranoid, you should just use a different email address than the one known to your girlfriend. I just don't see this as a problem.

Re:Seems to me...

[Qzukk]

that if you are that paranoid, you should just use a different email address

Seems to me that if a society decides that paranoia is required in order to "earn" privacy, it should quit being surprised when it creates paranoid people.

Re:Seems to me...

[LighterShadeOfBlack]

Seems to me you should never give out your emmail address to your girlfriend, period. And why take any risks, don't even give them your number, or your real name for that matter. Personally I prefer to be extra careful about giving out personal information, I don't let them see my face or even let them know that we're dating.

It's going pretty well with my latest one I think. She's a bit shy though. Every time I call her it's nothing but awkward silences. Plus she's started closed the curtains :(

Re:Seems to me...

[speaker of the truth]

Seems to me if society creates people who can't be honest with each other, it should quit being surprised when people in relationships distrust their significant other.

Re:Seems to me...

[BosstonesOwn]

Dad ?

Re:Seems to me...

[Anonymous Coward]

Seems to me you should never give out your emmail address to your girlfriend, period.

Bad idea. Have you compared the emails men send to the emails women send? Whenever a male friend of mine sends me dirty pictures, it's always a transsexual. Whenever a female friend of mine or girlfriend sends me dirty pictures, they are gorgeous (real) women. I much prefer getting email from women than men.

Re:Seems to me...

[Anonymous Coward]

> Whenever a male friend of mine sends me dirty pictures, it's always a transsexual.

They're obviously trying to tell you something.

Re:Seems to me...

[Anonymous Coward]

Funny? This was totally insightful.

Re:Seems to me...

[bcharr2]

Seems to me that if a society decides that paranoia is required in order to "earn" privacy...

Except in this case, it is the individual themselves who is the custodian of their own privacy. If they have something to hide, they should use a email account that no one else is aware of.

Not that I sympathize with the original poster, who is arguing for privacy rights simply as an avenue of deceiving someone who is in a close, personal relationship with them. I believe the founding fathers concept of privacy was closer to "protecting your spouse from being forced to reveal your private thoughts to a jury" than in "protecting your infidelity from being discovered by your spouse".

Infidelity isn't cool.

Re:Seems to me...

[vux984]

Seems to me that if you want to cheat on your girlfriend, your not with the right woman, and should probably just do the honest thing and tell her that.

Re:Seems to me...

[GryMor]

Is having a match.com account evidence of infidelity? I mean, she didn't even check when it was last used. I've got accounts on several dating sites, but for the most part, I haven't touched them in years. If I actually had a girlfriend, I don't see how the sites would know to close my accounts, and I certainly don't think it would occur to me to do so.

The issue here isn't inherently privacy related, the problem only exists because people presume that your email address having an account indicates something other than you have looked at the site, sometime since the site was started, and even that is presuming it wasn't a typo or intentional subterfuge on someone elses part.

Re:Seems to me...

[Anonymous Coward]

forced to reveal your private thoughts to a jury

I know it's the "in" thing to insist that your rights are only protected from "the government", but what government ordered Adam and Eve to put on the fig leaves?

Privacy is older and greater than any government.

Re:Seems to me...

[Anonymous Coward]

What, and give up the fallback fuck?

...thought it mattered

[Radon360]

CT: We'd fix it if I CT: We'd fix it if I thought it mattered]]

Thought it mattered?!? I don't want people being able to find out that I'm a nerd!

...oh wait.

I can see it now...

[Billosaur]

Harold, I know... you've been on that Slashdot site again haven't you? Haven't you? Admit it!!!! You're fooling around with Ubuntu... behind my back!!!

Re:I can see it now...

[Rob T Firefly]

Honey, no! I mistyped the URL for digg, I swear! You know I would never betray you and Gentoo...

Re:I can see it now...

[Kjella]

Harold, I know... you've been on that Slashdot site again haven't you? Haven't you? Admit it!!!! You're fooling around with Ubuntu... behind my back!!!

We need to have a talk. Dear aunt, let's set so double the killer delete select all.

Re:I can see it now...

[Anonymous Coward]

> Admit it!!!! You're fooling around with Ubuntu... behind my back!!!

You mean her?
http://ubuntu.wordpress.com/2007/04/11/ubuntu-tan- wallpapers-make-up-for-missing-ubuntu-mascot/

Privacy on match.com?

[rob1980]

Think about the purpose of that site for a second: the whole idea of match.com is you post a picture and a profile so you can meet new people. You're already spilling a ton of personally-identifiable information about yourself, and presumably someone is going to be able to search for you - so why get pissy about someone being able to determine that your e-mail address is registered there?

And while I'm thinking about it, if you're using match.com while you're already in a relationship with somebody then maybe you need to have a talk with that person and let them know things aren't working out.

Re:Privacy on match.com?

[d0rp]

Think about the purpose of that site for a second: the whole idea of match.com is you post a picture and a profile so you can meet new people. You're already spilling a ton of personally-identifiable information about yourself, and presumably someone is going to be able to search for you - so why get pissy about someone being able to determine that your e-mail address is registered there? That's what I was thinking too. Also, in the example given, there's no mention that the account is currently active. What's to say that the guy had an account previously and has since discontinued it's use? Wouldn't his email address still be tied to an (inactive) account?

Re:Privacy on match.com?

[smellsofbikes]

>if you're using match.com while you're already in a relationship with somebody then maybe you need to have a talk with that person and let them know things aren't working out.

Kind of like how if you start looking for a new job, you invariably let your boss and coworkers know that with any luck you're going to be leaving soon, right?

I'm not saying it's *right* to be looking around when you're in a relationship, unless you're one of those godforsaken poly people, but there are lots of people who do exactly what he's talking about and stand to get in trouble if someone does what he's trying. Whether or not you agree with it, it's very common human behavior.

Re:Privacy on match.com?

[vux984]

but there are lots of people who do exactly what he's talking about and stand to get in trouble if someone does what he's trying. Whether or not you agree with it, it's very common human behavior.

Just being a jackass is common behaviour doesn't mean we should stop criticizing people when they act like one. The more society tolerates being a jackass, the more people will assume being a jackass is ok.

Re:Privacy on match.com?

[vux984]

Also, in the example given, there's no mention that the account is currently active. What's to say that the guy had an account previously and has since discontinued it's use? Wouldn't his email address still be tied to an (inactive) account?

The real question is 'so what'? If *I* had an long disused and inactive 'match.com' account and my wife found out about it, so what, I've got nothing to hide.

Of course, my wife wouldn't have to ask match.com, she could (and would) just ask me.

And no, this isn't a case of 'if you aren't doing anything wrong, then you don't need privacy' its simply a case of: 'i don't need that kind of privacy from my wife'.

That said, I do think divulging list membership *is* something of a privacy concern. But perhaps, on some level, if you join a public group, and wish to remain anonymous you should be obligated to take steps to be anonymous. (e.g. use a throwaway email address).

In order to satisfy the criteria that it be a unique identifier, other people have to be denied using it -- if they are denied using it, they know its in use.

The website really can't do anything about it, they don't want multiple users using the same address, nor do they want the same user using an address multiple times, thus the unique criteria on the email address makes sense. And a direct consequence of that is that other people will be able to determine the address is in use by virtue of the fact that they aren't allowed to use it.

Re:Privacy on match.com?

[smellsofbikes]

One could substitute "animal-killing-and-eating" for "jackass" in your above statement, to justify militant vegan behavior, or "muslim" for much of the Western world's current standards, or even "male" to justify militant feminism. My point is: very widely-practiced behavior is, by definition, normal, even if by your standards it's lousy. To criticize huge swaths of people for doing something that is A: normal and B: in their best interests, is Quixotic.

Re:Privacy on match.com?

[vux984]

To criticize huge swaths of people for doing something that is A: normal and B: in their best interests...

is a straw man argument.

I am critical of people for doing things that are NOT in their best interests. Of course, I have a broader definition of 'best interest' than just greedy self-centered hedonistic 'what makes me feel good right this second'.

Re:Privacy on match.com?

[smellsofbikes]

It's very hard to make that call from the outside. Was it in Kenneth Lay's best interests to ravage Enron? No: it probably killed him and he certainly would've spent the rest of his life in jail. But if he hadn't been caught? Then, as awful as it sounds, it would have been very, very much in his best interest to do exactly what he did: which is precisely why he did it. People are always caught between two competing goals, that of the community at large, and their own self-interest. Most of the time it benefits individuals to help their community, because the community will help them back, but there are rare times where it benefits an individual far, far more to be a selfish jerk. And, as it turns out, as the community gets larger and the repeated contacts between individuals decline, it becomes increasingly advantageous to be a selfish jerk, because the feedback gain is dropping and the hysteresis is increasing, in control theory terms. So, while a self-professed ethical person can decry selfish behavior, it has a good reason -- to each individual -- for existing.

Social Engineering

[Anonymous Coward]

Amazing how much stuff you can get done by asking. A friend recently bought a new house. To shut off the power to his old house he simply called the power company and gave them his name and old address. No more power to that house. Of course names and addresses are usually a click away but I bet you already know the name of your neighbor who blasts music all night....

Re:Social Engineering

[ArsenneLupin]

but I bet you already know the name of your neighbor who blasts music all night.... A very efficient method indeed. But you better get a good UPS before you do that, because your neighbor certainly also knows where the geek who can't stand loud music lives...

Re:Social Engineering

[kalirion]

I remember back at college, called the towing company and got a car towed from a professor's reserved parking space. It was the professor's car.

Re:Social Engineering

[multipartmixed]

Hell, that used to be a standard vengeful prank back in the BBSing days. Call up the phone company and tell them "you" you want your modem line disconnected, here is the number...

Re:Social Engineering

[evanbd]

I'm told one can get a port-a-potty delivered without any confirmation; just name and address. Of course, when you want it cleaned, taken away, or even just a month later, they want money...

Re:anyone here use match.com?

[joto]

You need to work on you gheyness

Saved By The Force

[andrewd18]

Simple fix - just train all your customer support employees in the light side of The Force. The conversation changes into:

Theoretical Girlfriend: I think my boyfriend might be cheating on me. His e-mail address is joeblow - at - aol - dot - com. Can you tell me if he's a member?
Phone Support: You don't need to see his identification.
TGF: I don't need to see his identification.
PS: This isn't the guy you're looking for.
TGF: This isn't the guy I'm looking for.
PS: He can go about his business.
TGF: He can go about your business.
PS: Move along.
TGF: Move along... move along.

Problem solved.

Re:Saved By The Force

[Anonymous Coward]

You can use the "I've lost my password" form on their website. The question: Does it give an "OK" response if it knows the email address - and an error if it doesn't?

Although:

(1) you need to know someone's date of birth (this is a really good idea actually).
(2) they'll receive an email saying that someone's trying to reset their password.

Re:Saved By The Force

[Achromatic1978]

(1) you need to know someone's date of birth (this is a really good idea actually).

If you're worried that your partner is cheating on you, and you don't know their date of birth, I'd also be questioning your commitment to the relationship.

Login error notifications

[tonypeters]

So many sites out there tell you if you have got your email address or password wrong when you log in, when what it should do is tell you that your email OR password are incorrent. By entering someone elses email address (if used for login) into one of these sites, you can tell if they have registered or not.

Re:Login error notifications

[Anonymous Coward]

Actually, most sites do this. And it's annoyed me on a number of occasions where I wasn't sure if I was entering the wrong email or wrong password.

disposable web mail

[Anonymous Coward]

If you can't be bothered to spend the time on creating a disposable Yahoo, Gmail, Hotmail or whatever then you should get caught. That is like robbing a liquor store with your name and address printed on the back of your shirt. Even the dateline predators created new accounts like "analrapist69@yahoo.com" or whatever.

Re:disposable web mail

[Lurker187]

If you can't be bothered to spend the time on creating a disposable Yahoo, Gmail, Hotmail or whatever then you should get caught. That is like robbing a liquor store with your name and address printed on the back of your shirt. Even the dateline predators created new accounts like "analrapist69@yahoo.com" or whatever. Tobias: No, no, it's pronounced 'a-NAL-ra-pist'.
Buster: It wasn't really the pronunciation that bothered me.

Re:anyone here use match.com?

[Anonymous Coward]

I met my wife there. I'm wishing now I hadn't.

Enjoy being single. Marriage isn't all it's made out to be.

Either you're together, or not, or you're open...

[davidsyes]

But if you're NOT "open", then think about your other half/significant other/whatever. If you're mutually apart for a period of time (a day, a week, whatever) then you've got a limited window. If you violate your other half, then you should have IN ADVANCE considered and expected to accept the consequences.

If Joe Blow gets caught, tough. If his girlfriend KNEW he was logging in to such sites, then she could live with it or walk away on her own. IF she finds out by other means, whatever they may be aside from personally breaking into his computer/s, then tough for him. Maybe people should mutually declare or assign a "sanctity rating" to their relationships so they can responsibly handle each others' emotions so no one is crushed when an occasional fling occurs.

Oh well, so many people are feeble-minded. And, DAMNED RUDE with others' feelings

Captch: "odorous"

Does anyone expect privacy in this digital era?

[Noose For A Neck]

Now, I can't speak for everyone who reads Slashdot, but when I go online and, for example, order computer parts from Newegg, I have no illusions about the safety of my personal information. It is unrealistic to expect, in this age of running Windows on servers and constant security breaches of merchants, that the information you give out online will remain secure. The best that I expect to do is damage control, which involves frequently monitoring my credit card transactions, using throwaway email accounts from various free email providers such as Yahoo! and Google, Snape dies so Harry can kill Voldemort without dying and using web proxies to access sites where I will be doing things that I wouldn't want everyone I know or don't know to find out.

I think the best a savvy 'net user can do these days is to give up on the hope that someone else is going to protect you and take matters into their own hands. That's why projects such as Tor are so important, not just for Chinese dissidents and child pornographers, but for average citizens like you and me who might not want the whole world to know that we are buying books on dealing with grief or surfing internet dating sites. Because we can't rely on the government to protect us when the interests of Big Business run counter to our own.

Re:Does anyone expect privacy in this digital era?

[Anonymous Coward]

The best that I expect to do is damage control, which involves frequently monitoring my credit card transactions, using throwaway email accounts from various free email providers such as Yahoo! and Google, Snape dies so Harry can kill Voldemort without dying and using web proxies to access sites where I will be doing things that I wouldn't want everyone I know or don't know to find out. WTF?! Book /ruined :(

an email address that's in use...

[yskel]

...should be considered public information. The street address comparison seems analogous here in many ways - just like anyone can see your address from the street, any time you use an e-mail address as a UID, it should be assumed that it's public. In other words, there should be no expectation on the part of someone sharing their address that it'll be kept secret.

I'm not saying this is a good thing (I think that, in general, sites that collect private information have at least an implicit responsibility to keep it private), but the bigger issue is that the average internet user needs to be aware of these really basic facts. Just like he/she needs to be skeptical enough not to click through to phishing attacks.

Until the state of awareness on these issues increases, there will always be opportunities for these sorts of marginal attacks on people's privacy.

Re:an email address that's in use...

[J'raxis]

Saying that one can discover that someone's email address is registered at Match.com would be like saying one should be able to discover that someone's street address is on the ACLU's mailing list. You're confusing the fact that someone can find out simply that an address exists with finding out what other things the address has been linked to or used for.

Re:anyone here use match.com?

[Billosaur]

20+ y.o. male geek, likes long walks on the beach, dark rooms, WoW, and Ubuntu, seeking female with similar interest to keep me company in my parents basement while I hack -- prefer a virgin.

Privacy in the US Sucks.

[Anonymous Coward]

This will NOT change until we start getting our elected officials to actually listen to their constituents--instead of having their heads up their asses and their palms greased by lobbyists.

Is privacy really a good thing though?

[Hal_Porter]

I like the idea of a Panopticon style world actually, with no privacy at all. My parents live in a distinctly non private village where everyone knows what everyone else is doing and it has no crime whatsoever.

Re:Is privacy really a good thing though?

[Pyrion]

Is that village isolated from the outside world though?

There may be no crime perpetuated by the villagers themselves but what of visitors?

Re:Is privacy really a good thing though?

[Anonymous Coward]

My parents live in a distinctly non private village where everyone knows what everyone else is doing and it has no crime whatsoever.

Yeah, I think I've heard of the village.

Re:Is privacy really a good thing though?

[Anonymous Coward]

Yes, we've all heard about those villages and other tight-knit communities. FWIW incest is considered a crime in the civilized world.

Re:Is privacy really a good thing though?

[moeinvt]

"I like the idea of a Panopticon style world actually, with no privacy at all."

Are you serious? First sentence in the article: "The Panopticon is a type of prison building . . . " Which is exactly what a world without privacy would be.

"May your chains set lightly upon you, and may posterity forget that ye were our country[man]."
Samuel Adams

Re:Is privacy really a good thing though?

[John Hasler]

> Are you serious? First sentence in the article: "The Panopticon is a type of prison
> building . . . " Which is exactly what a world without privacy would be.

The key feature of the Panopticon is that the guards have complete privacy. The prisoners can be observed at any time but can never know who is watching or when. In a world without any privacy you would know who was watching you when and could watch them in turn. Knowledge is not power. Secret knowledge is power.

Re:Is privacy really a good thing though?

[StewedSquirrel]

oh my god that is so scary!

People, by simple human nature, are irrationally judgemental.

Given omniscience, most people will seek to place themselves above the people they observe, on a moral scale and will seek out faults with their behavior.

Given that the total lack of privacy is associated with all sorts of serious psychological and developmental problems, it seems a profoundly bad idea.

Lack of crime is not indicative of a healthy society. It may be one small metric, but personal happiness is better obtained through liberty, freedom and privacy at the expense of saftey. I think the ideal is a balance point in the middle.

I think our culture is already swaying too far into the 'nanny state' and the UK has gone even further, to the point that most people fear the police on instinct and mistrust their neighbors in a way that would have seemed absurd 50 years ago.

On the other hand, the utter anonymity of a huge city does cause people to grow antisocial.

So here are the two hands.

1) A totally anonymous person has no reason other than internal fortitude, to have any morals. Having a sense of responsibility for oneself is a stabilizing force.

2) A person totally lacking privacy and anonymity has no individualism, other than that which is granted to him by the watchers, which leads to all sorts of crazy dissociative personality disorders, etc.

Surely there is a balance, right?

Panopticon.... sheesh

Stew

Re:Is privacy really a good thing though?

[bjorniac]

Your Dad isn't Patrick McGoohan, is he?

Re:Is privacy really a good thing though?

[vidarh]

It also would have no real freedom to do things which are legal but enough out of the mainstream to cause significant problems if your neighbors and family knows. Depending on where you live, that can be anything from being a member of a fringe political group to sexual preferences.

Re:Is privacy really a good thing though?

[Anonymous Coward]

I like the idea of a Panopticon style world actually, with no privacy at all. My parents live in a distinctly non private village where everyone knows what everyone else is doing and it has no crime whatsoever.

My grandmother lived in such a place before I was born. I remember overhearing her telling someone once about how after they worked out the local schoolteacher was gay, he had "accidentally" driven off a bridge and drowned. The bruises on his head, and the fact that the car engine obviously wasn't running when it entered the water were kind of hard to explain, but it was obviously an "accident". No crime here. *wink* *wink*

Lack of privacy leads to a tyranny of the majority. But hey, only minorities who have something to hide, have something to fear.

Re:Is privacy really a good thing though?

[Hal_Porter]

There may be no crime perpetuated by the villagers themselves but what of visitors?

My Dad told me two stories about visitors to the village. In one, a large group of gypsies arrived and camped on one of the fields. They had lots of dogs running around, music playing, hordes of verminous children shouting and so on. The villagers watched them from inside their houses, and from inside the pub. After a while, some local emerged from the pub and gave the gypsies some friendly advice. There are lots of farms there, and farmers don't like to see dogs off the leash. The gypsies told him to f*ck off. He went back into the pub. Night fell, and everyone eventually went to sleep, even though the gypsies made a lot of noise late into the night.

When they woke up, the gypsies found all their dogs had been shot in the night. All the locals have shotguns, and some of them went hunting carrying them, walking past the gypsy encampment. The gypsies took the hint and left that day.

In the second, the locals told my parents that they before my parents bought a house there, people had seen them driving around, and thought it was suspicious. Someone had checked up on their license plate and other people had talked to them. Eventually word spread that they were basically civilised people planning to move there. Then the surveillance stopped.

So there's a kind of authentication process. If you show some respect, all is ok. But if the gypsies hadn't of taken the hint, things would have got really nasty. The police are essentially part of the system, so it's not like there are any laws restraining people from protecting it.

It's a sort of oligarchic utopia utopia really, an example of a society that works well because it ignores liberal sacred cows like the right to privacy. I rather admire that, and want to try to extend that system to the UK as a whole. There are clear analogies for example from the gypsies to criminals or fundamentalist Muslims and from my parents to people who are moving to the UK in good faith. The UK hasn't traditional been a country of universal rights, that's an idea no older than the current Labour government. They've backed down on it somewhat.

E.g. look at this

http://www.mailonsunday.co.uk/pages/live/articles/ news/news.html?in_article_id=457934&in_page_id=177 0&ct=5

The Mail on Sunday is a Tory paper and interestingly they also link to an article on "Human rights nonsense", about how extending rights to people that are hostile to civilisation hampers the government. They mention approvingly that the Tories will derogate from the human rights act.

In village terms, you could say that the FTAC is the locals in the pub, and the terrorists suspects are the gypsies. Some people are alien to culture of the UK and the people that run it can quite legitimately decide to deny them rights that they would have if they made some attempt to fit it. Most of the people in the village are Tory voters, and now that Blair is going, ironically brought down by the far left, there is a fair chance that derogation will end its brief experiment with US style inalienable rights.

Essay?

[AutopsyReport]

I don't know, but I'll be sure to let everyone know when I finish page 467 of the book you just wrote.

Proper password management

[Charles Dodgeson]

Many (most) email systems now will allow suffixed addresses, typically using "+" as the separator. Chances are that most of the services that use email address as a username or have the features that allow a third party to detect whether a particular email address is registered will treat "foo@domain.example" as entirely distinct from "foo+bar@domain.example". So most people have easy access to throw away addresses. Unfortunately this doesn't fully solve the problem. Sites use email addresses as identifiers exactly because people remember their own. Using unique addresses for each service defeats that purpose.

The real solution to the real problem is for people to use proper username and password management tools. With such tools users don't have to remember their usernames and passwords, so schemes that try to verify whether a username is registered on a system won't identify to the world the person behind that username the way an email address might.

Oh pfeh.

[Pyrion]

You don't even have to ask most sites. Just punch in the person's email address in the "forgot password" form page and see if it corresponds to a registered member's email address. If it's not in the database, you'll get an error. If it is, they'll get a reset password email that they never requested.

Re:Oh pfeh.

[DerekLyons]

You don't even have to ask most sites. Just punch in the person's email address in the "forgot password" form page and see if it corresponds to a registered member's email address. If it's not in the database, you'll get an error. If it is, they'll get a reset password email that they never requested.

Try reading TFA. He not only covers this attack - he discusses it's drawbacks.

Call me old-fashioned ...

[PhxBlue]

I believe a person's right to privacy ends when they're breaking the law -- adultery is still illegal last I checked, at least insofar as it's a violation of a marriage contract -- or when their actions are causing harm to an innocent third party.

And as others have already stated, a privately owned Web site doesn't have to respect your right to privacy. You signed up for their service; within their terms of service, they can do whatever they damn well like with your user information.

Re:Call me old-fashioned ...

[plague3106]

You're a dolt. Adultery is NOT illegal in almost every county in the US. That, along with many other blue laws have been tossed out years ago. What contract did you sign when you got married? Most people only get a piece of paper stating that they are married.. there are no terms on it.

Re:Call me old-fashioned ...

[FatMacDaddy]

While I wouldn't say that this guy had as yet done anything illegal (maybe slimy), you're right about privately owned web sites not having to respect one's right to privacy. Especially because in the USofA, there is no right to privacy. We have that expectation, but there is no constitutional right to it. This was hardly an issue when the constitution was written, but I think the time has come to address that.

Re:Call me old-fashioned ...

[Vellmont]

I believe a person's right to privacy ends when they're breaking the law -- adultery is still illegal last I checked

Maybe in some states, but last I checked it's not illegal in most states.

at least insofar as it's a violation of a marriage contract --

I don't know much about marriage law. But I've never heard of anyone being charged with a crime, at least in the last 30 odd years for committing adultery. I was under the impression most states had "no fault divorce laws" on the books many years ago.

or when their actions are causing harm to an innocent third party.

Wow, if "causing harm to an innocent third party" (assuming non-physical) is illegal, then can I put Rush Limbaugh in jail because he pisses me off?

Re:Call me old-fashioned ...

[PhxBlue]

Especially because in the USofA, there is no right to privacy. We have that expectation, but there is no constitutional right to it.

Actually, that falls under Amendment 9. The government doesn't explicitly get to regulate it, therefore it belongs to the people.

Re:Call me old-fashioned ...

[ewieling]

That is odd. I never signed a contract when I got married. If I was still married would I be arrested for not signing the "marriage contract"?

Just because something is illegal does not mean it is wrong. Just because it is wrong does not make it illegal. For example, it is illegal in the USA state of Georgia to have oral sex with your wife. At least it was in 1989 when James David Moseley went to prison for 17 months for going down on his wife. It was consensual. http://www.ling.upenn.edu/~kurisuto/sodomy.html

I have an open relationship. Each of us get to play with most anyone we want to. There are a few rules, but not many. In my world there isn't a lot of difference between "lying" and "cheating" in a relationship. They are both a violation of trust.

I don't have a lot of sympathy for a guy that is on match.com trying to "find someone the side", but only because he is trying to hide it. To me that is also a violation of trust.

Re:Call me old-fashioned ...

[sconeu]

Depends. If you're Jewish, then you *did* sign a contract. Your Ketubah is a contract. Because a Jewish marriage is a contract, that's why you can't get married on Shabbat.

Re:Call me old-fashioned ...

[PhxBlue]

Wow, if "causing harm to an innocent third party" (assuming non-physical) is illegal, then can I put Rush Limbaugh in jail because he pisses me off?

No, you have to get him for abusing prescription drug medications.

I didn't mean to imply that causing harm to an innocent third party is illegal, but it is clearly wrong, at least IMO.

Re:Call me old-fashioned ...

[Anonymous Coward]

Maybe you're not married anymore because you're a male slut.

Re:Call me old-fashioned ...

[UbuntuDupe]

Wow, a lot of the responders were kind of beside the point, so let me sort through:

-No, there isn't necessarily a "marriage contract".
-But, the law typically is specified so that by getting married, certain obligations attach.
-Yes, adultery is legal in some places, BUT not others
-Breach of contract isn't the same thing as breaking a law.
-But, the website will typically have a policy against married users signing up.
-But, and this is the most important, just because someone claims they're married to a user and want you to share information, doesn't mean you should believe them and comply. That was the point all along! There are proper channels to go through, and the site should give that level of information that easily.

Re:Call me old-fashioned ...

[Anon-Admin]

I believe a person's right to privacy ends when they're breaking the law -- adultery is still illegal last I checked, at least insofar as it's a violation of a marriage contract -- or when their actions are causing harm to an innocent third party.

From the statement, I guessed that you were female. Most females I know seem to think that adultery is illegal or if it is not, that it should be.

Sorry Jennifer, it is not illegal. I thought pagans enjoyed a verity of non-standard living arrangements... Polygamy, etc.

The problem is that there is little to no privacy and few really understand that.

Re:Call me old-fashioned ...

[PhxBlue]

I have an open relationship. Each of us get to play with most anyone we want to. There are a few rules, but not many. In my world there isn't a lot of difference between "lying" and "cheating" in a relationship. They are both a violation of trust.

I agree. Polyamory introduces a third dimension of complication, but the basics -- trust and communication -- are equally essential for any poly relationship as for any monogamous relationship. Maybe more so, because there's a lot of communication required from the very beginning insofar as explaining what polyamory is (at least to non-poly folks), what it means in the context of a relationship, what the ground rules are for relationships, etc.

On the other hand, I think poly folks have a leg up on most monogamous folks because they know they can't take any of this stuff for granted. Whenever people don't communicate (because of assumptions), they leave themselves open to being hurt.

Re:Call me old-fashioned ...

[hasbeard]

I am not a lawyer, and I have not researched the laws of all 50 states. I do know that in my county an individual was recently sued for "Alienation of Affections." The defendant lost the case. I can't remember if the defendant had to pay damages or, if so, what the damages were. I am not aware of a criminal penalty for adultery where I live, but it seems there is a civil liability for the person who instigates the breakup of a marriage.

Re:Call me old-fashioned ...

[PhxBlue]

From the statement, I guessed that you were female.

Wow. Fifty percent chance of getting it right and you screwed the pooch.

Pagans are generally more open-minded, yes ... but the same rules of communication and trust apply no matter what sort of relationship you're in.

Re:Call me old-fashioned ...

[plague3106]

I can't speak for Jewish people, I don't know any anymore.

Even if its a legally binding contract it still doesn't support the OPs sweeping generalization. The fact is in the US, most marriages are not covered by any form of contract and adultery is not illegal in most places.

Re:Call me old-fashioned ...

[Trillan]

No offense meant, but I think a monogamous couple with good communication has a leg up on that. :) However, I'll grant you that most couples have lousy communication.

Re:Call me old-fashioned ...

[brkello]

What contract would this be? You don't sign anything that says you will be sexually faithful to your spouse. In fact, some marriages allow this activity. There is nothing illegal about it. Immoral, sure...but if this were a law, why would Clinton still be running free or without a fine?

Re:Call me old-fashioned ...

[Vellmont]

I didn't mean to imply that causing harm to an innocent third party is illegal, but it is clearly wrong, at least IMO.

I guess my point is that harm is pretty relative. I'd agree that adultery is wrong, but making a blanket statement about harm to "innocent" people goes too far. What's harm, and what's innocent? If I call George Bush the worst president in history, and it hurts his feelings, have I harmed him?

Re:Call me old-fashioned ...

[Cancer_Cures]

well obviously, a. a bj is not sex OR adultery b. laws do not apply to presidents

Re:anyone here use match.com?

[CrackedButter]

I find there's too many women on this site. I'm going to check out digg.

Mod Parent Down

[PhxBlue]

For squirting spoilers into the text of his post. Jackass.

Re:Mod Parent Down

[Anonymous Coward]

What are you talking about? Everything he said about the iPhone is already well-known, even if you don't browse rumor sites.

Re:Mod Parent Down

[75th Trombone]

Fortunately it's not a real spoiler, and even if it were, it's such an obvious thing to suggest that it's easily dismissed as a moron pretending to be a spoiler troll.

Re:Either you're together, or not, or you're open.

[faqmaster]

The couple that porns together, stays together.

Sex Offenders Will Have It Rough

[Anonymous Coward]

Just think of the fun that people are going to have when they get their hands on the sex offender email list. Spammers will KNOW that these are valid emails. I reckon that people will use the Sex offender list to sign them up for all kind of things. The attacks listed in the article show that it's way to easy to mess with people when you only have a little information about them.

Re:anyone here use match.com?

[inkedgeek]

Wow I'd fit your needs perfectly. Too bad I'm gay and looking for the same girl. ;)

i am almost certain that:

[FudRucker]

Match.com and Yahoo's personals were both caught and fined for creating fake identities...

would you trust match.com and yahoo? not me...

Shame...

[AVee]

Big deal, an attacker can find out whether you're a Netflix user -- but that's not a huge privacy violation, it's not like I shamefully hide those red envelopes under my shirt while I'm scurrying back from the mailbox.

So here you are, making a big fuss about some perceived privacy problem. Yet appearantly privacy mainly means being able to hide the thing you are ashamed of. If that is all you are concerned with your privacy is not the problem.

So let me get this straight...

[untaken_name]

You want to be able to go get all the services you want while maintaining total privacy, huh? Well, if you want privacy, I have a 100% guaranteed-to-work solution for you. Don't give your email address out. Don't sign up for stuff on the web. If you're going to go in 'public', you're going to lose 'privacy', see, because they're opposites. That's how it works. You can go as emo about it as you want. It won't change the fact that in public, there is no expectation of privacy. (excepting that of your person, but that's not applicable online because you don't have an online 'body')

Re:anyone here use match.com?

[Anonymous Coward]

If you find her, for pity's sake take pictures!

If you don't understand the system your either:

[Browzer]

a. deserve to be caught
or
b. should not be fooling around

Not exactly the same thing, but I know a few married, computer-illiterate people who correspond daily with their fling using email. They think it is safe just because their local computer account is password protected. At the same time, their email program (OL, TB) is set to remember the password, and don't mind walking hand and hand with their fling down Broadway.

Re:If you don't understand the system your either:

[giorgiofr]

Wowzer. Like it takes that much effort to crack a locally accessible box. But I've seen worse. Like interns chatting on MSN, totally oblivious to the fact that the program was logging all their conversations. It made for some fun reading by the people in that office, I've been told. (To their defense, they didn't know that the program was set up like that and only found out later)

Re:If you don't understand the system your either:

[Anonymous Coward]

[If you don't understand the system your either:]
a. deserve to be caught
or
b. should not be fooling around

If you mean "deserve" in a moral sense(and frankly, I don't know of any other sense), then I really don't understand what you're trying to say. (I'm assuming you mean "if and only if", and that this isn't just a roundabout way of saying that anyone who's fooling around deserves to get caught.)

Wouldn't this imply that Bruce Schneier somehow would be more morally justified in having an affair than Joe Blow, under otherwise equal conditions?

Isn't that an absurd conclusion? Why should knowledge of computer security morally entitle one to betray other people's trust?

Why would you use match.com?

[Colin Smith]

Okcupid is free and has some geek cred, it uses a least squares regression to match people.

And why would you use your regular email address? There is no anonymity on the Internet.

Re:Why would you use match.com?

[gdr]

Okcupid is free and has some geek cred, it uses a least squares regression to match people.

But what if I want to meet more squares?

Re:Why would you use match.com?

[EricWright]

But what if I want to meet more squares?

Keep posting on /.

How much privacy should one expect?

[richg74]

As a practical matter, I have always assumed that anything that I submitted to a Web site was public, or close to being so. At most, it might be secured with what my grandfather called "the kind of locks that keep honest people out." After all, I chose to submit the information -- and if I were really paranoid, nothing forced me to tell the truth. The one obvious exception is payment data for E-commerce transactions, which I do think reputable sites (e.g., Amazon) take care over, despite a few highly-publicized lapses.

As far as a relationship goes, I would say that if the parties are fishing around for each others' correspondence and Internet accounts, the relationship already has some pretty serious problems with trust.

Don't use your personal email address!

[gsslay]

It's simple really. Maintain 3 email addresses.

The first is your personal email address you give to friends and people who you actually want to communicate with.

The second is your 'account' address you give to companies, organisations, websites that you either have a financial arrangement with or some other connection that you actually care about.

The third is your 'trash & spam' address you give to websites/organisations that demand it, but you don't care about and never read.

I do this, and no person or organisation knows of the other. Not because it's a massive secret, but simply because they've no need to know. So in the scenario given here; my signup at Match would either be on my 'account' or 'trash & spam' email address and my girlfriend would only know my personal address.

Anyways, if I was the lying, cheating type, all I'd need to do would be tell the girlfriend that it was a ancient account I signed up to years ago and never use now.

Re:Don't use your personal email address!

[harry666t]

Why waste your time setting up 3rd address, just pick a random one :) you say you never read it anyway, so... :P

Re:Don't use your personal email address!

[wyztix]

cjb.net and dynDNS.org offer domain mail forwarding. Mean if you want to register the free domain paranoid.cjb.net, you own *@paranoid.cjb.net : should give enough emails ;)

Re:Don't use your personal email address!

[zygwin]

The third is your 'trash & spam' address you give to websites/organisations that demand it, but you don't care about and never read. That's what my yahoo ID is for. :)

Re:Don't use your personal email address!

[Slashdot Parent]

You know, it's funny. I had this very same idea in about 1995 and even put it into effect.

I do this, and no person or organisation knows of the other.

I found this not to be the case.

Some friend would send me an eVite, or forward me an article, or send me one of those god-awful online greeting cards, etc.

Next thing I knew, websites that would have gotten my "trash and spam" email address had I signed up personally were getting my "friends and family" address from my.. well.. friends and family.

Oh well. It was a good idea while it lasted.

Re:Don't use your personal email address!

[Ernesto Alvarez]

That would be two real addresses and mailinator.

Dump her!

[danlock4]

I wouldn't want a girlfriend that would not trust me enough to ask me directly if I'm a match.com member. I would, of course, answer honestly.

If a girlfriend treats you with that much mistrust, you probably don't have a happy future together.

Re:Dump her!

[Anonymous Coward]

If a girlfriend treats you with that much mistrust, you probably don't have a happy future together. ...Though you should probably wait until you've found your replacement Match.

Please stop...

[Anonymous Coward]

Please stop calling "type in the numbers that you see" a Turing test. I find it insulting.

-Eliza

Re:Please stop...

[Anonymous Coward]

Oh, a Turing test? We were discussing you, not me. Could you please elaborate on that?

Re:Please stop...

[Anonymous Coward]

We were discussing you not you? Really?

match.com?

[Anonymous Coward]

Why would anyone care if you had an account at a site specializing in philluminism?

Re:anyone here use match.com?

[BosstonesOwn]

News flash ! Any females that meet that criteria ARE virgins.

As for me , give me a dirty girl every day of the week over a virgin , them dirty girls know how to work it !

Article starts off with wild assumptions

[192939495969798999]

"Suppose your girlfriend"....you can stop right there, buddy, this is slashdot!

Re:Article starts off with wild assumptions

[DustyDervish]

Good one.

Re:Article starts off with wild assumptions

[azenpunk]

wait, lets count. how many comments in is this joke?

An even simpler solution

[Todd Knarr]

I use an even simpler solution to the problem than any Mr. Hasselton suggests. Each site I sign up with where I care about this gets a unique e-mail address dedicated to them, one that isn't my regular e-mail address. I don't bother telling anyone else what these site-specific addresses are because nobody but that site should be sending mail to them anyway. Anyone checking my regular e-mail addresses would get back "not a member", since that address isn't a member. They can try and guess what different address I used, but that's only likely to work for sites like eBay where having an account isn't particularly embarrassing. For someplace like Match.com I'd be using something plausible but arbitrary like "tk487c5", and that's going to be all but impossible to guess if you don't know what it is already.

joeblow?

[wbren]

"I think my boyfriend might be cheating on me. His e-mail address is joeblow - at - aol - dot - com. Can you tell me if he's a member?"

Was the submitter really worried about poor joeblow@aol.com being hounded by a spambot? I mean, his email address is joeblow@aol.com for Christ's sake...

Re:joeblow?

[RobertLTux]

this is a thing called not spider baitng if you always mung addresses when using them in a posting then you won't attract spiders looking for addresses (at least ones simple enough to use a subset of the whichever RFC only)

Would you swim in shark infested waters with a gash in your leg?? same kind of thing

me i happen to have a full domain (with 350 gigs of space) so i don't really care if i get spam on that domain (but i don't have a catchall)

Re:joeblow?

[dealmaster00]

If he was, it appears you've rendered his original intentions useless...

CORRECTION

[UbuntuDupe]

I know it's obvious from context, but just to pre-empt a long lecture: the last statement should be "There are proper channels to go through, and the site shouldn't give that level of information that easily."

Slashdot is the most secure site out there

[GBC]

It is necessary to have a girlfriend (whatever that is) for this to be a problem, so I guess we are all safe...

Suspicious data

[moderatorrater]

His argument that the requests would only be suspicious if the attacker is logged in misses some of the point. Let's say that Match.com usually gets 10 password requests per second, now they're suddenly getting an average of 15. That's a significant increase, so then they'll do some data mining or start requiring a Turing test. Also, his argument depends on not having to reuse any IP addresses, since the same IP address checking 3 email addresses that correspond to 3 unrelated accounts would be suspicious. I'm not saying that it's not harder to spot the attack when someone isn't logged in, but I am saying it's not impossible.

Re:anyone here use match.com?

[Anonymous Coward]

Every self-important neurotic loser I know has a match.com account. If you're looking for someone with issues (that probably rival your own), I'd say it's the de-facto place to go.

Re:Either you're together, or not, or you're open.

[Anonymous Coward]

Not every fling deserves to be made known - sometimes people keep secrets from their partner because they love them. And relationships based on a pre-determined set of rules are not appropriate for most couples, because most couples are emotional and fallible human beings.

There are easier ways

[rehtonAesoohC]

One of the examples in the essay is that a girlfriend wants to know if her boyfriend is cheating on her... but by checking if he has an account?

Give me a break... First of all, what if he created the account several years ago and hasn't visited in that long? If the said girlfriend sees only that he has an account and automatically jumps to "He's cheating on me, the louse!" then I think they have some trust issues that go way deeper than Match.com.

Second of all, it's a social networking / matchmaking site. How difficult would it be to sign up for a freebie account and just search for his damn name? Seems to me like that would be a lot more definitive than checking the magic 8 ball of "Does he have an account?"

Re:There are easier ways

[Dunbal]

Give me a break... First of all, what if he created the account several years ago and hasn't visited in that long? If the said girlfriend sees only that he has an account and automatically jumps to "He's cheating on me, the louse!" then I think they have some trust issues that go way deeper than Match.com.

      I can tell from your post that you haven't been around women that much. Of course the mere fact that he has an account means that he's cheating. Who said women were rational, level headed beings? It's the first thing that comes to their minds.

Re:There are easier ways

[rehtonAesoohC]

I'm married actually. And sadly, you're not far off... I didn't want to bring it up, but I was looking up a friend of mine on myspace (I would never even consider making an account there) who sent me some invitation email, and she saw that myspace was in my internet history about two weeks later. She was looking for some pancake recipe that she had looked up the same day... Anyway, she freaked out and started asking why I was using myspace, etc.

Humbug.

Re:There are easier ways

[denidoom]

I think many women trust their husbands. It's the other women I do not trust.

Re:There are easier ways

[Intron]

Its amazing what you can find by just hitting the Back button a few times on an open browser window.

Re:There are easier ways

[acnard]

Second of all, it's a social networking / matchmaking site. How difficult would it be to sign up for a freebie account and just search for his damn name? Seems to me like that would be a lot more definitive than checking the magic 8 ball of "Does he have an account?"

Well, there you are. And then she would end up having an account there too and he could at that point symmetrically accuse her of cheating. Or, alternatively, claim that he'd only signed up to check out whether she was a member.
Kind of like holding up one mirror in front of another one.

Well, match.com accounts last forever

[wsanders]

I have a match.com account from more than 10 years ago when I was single, back when they offered free service. That email address (which is no longer valid) is still "claimed".

Wish I remembered the password, apparently the free account is still active, and can be sold to slackers on EBay for $$. Since the email is no longer valid (the domain name is long gone) I can't reset the password.

no data protection laws in the USA

[martin]

This is big problem with data protection laws in the US. There's lots of complaints about this sort of thing from the EU, and some slow moves to sort it out.

But until you get decent DP laws there's little you can do...

Re:no data protection laws in the USA

[John Hasler]

More laws are not the solution to everything. In fact, it's not the solution to much of anything.

Re:no data protection laws in the USA

[martin]

true, but without even basic data protection laws, your private data is open for sale/use to anyone....

Re:no data protection laws in the USA

[glesga_kiss]

More laws are not the solution to everything. In fact, it's not the solution to much of anything.

Not in this case. The UK Data Protection laws are pretty decent. In short:

Companies MUST

• Register what types of data they hold. A nasty advocacy group has "sexual orientation" on their list for people they don't like
  
• Make available ALL of the information they have on you on request. The comedian/activist Mark Thomas did this and got lots of emails saying "do not talk to Mark Thomas" about topic XYZ and so on. If it has your name on it (or any other personal data), you are entitled to see it and ammend it.
  

Companies MUST NOT

• Share the information without your explict concent. The default is "not share", you have to tick the "allow" box.
  
• Store infomation they have no need for.
  
• Send or store the data in a country without similar protections.
  
• "lose" or expose the data publicly. This is a chargable offence. So, all of the data leaks you read about in the states would have led to a procecution here.
  

The DPA is the UK implementation of a EU directive. Despite the best attempts of recent governments, the UK still has a lot of pro-citizen laws on the books. Our consumer protection is pretty good as a whole.

Paging CmdrTaco

[strredwolf]

Rob, I think it's time to fix that membership problem...

More of a concern to me

[halcyon1234]

I'm more concerned about a snot-nosed script-kiddie exploiting this. It's very easy:

1) Do as the poster suggests, and harvest a list of valid email addresses

2) Attempt to log on as those users (either by guessing that their username is probably the same as the username in their email address).

3) Repeat step 2 until the user account hits the "too many invalid login attempts" theshold, and gets locked out.

4) Repeat step 2 for every email address you have.

Voila. Service = denied. That user now has to go through the "reactivate my account" procedure, which probably involves several minutes of effort and possibly a Security Question that they might not remember. And if the script kiddie is doing his "job" right, that person will be locked out again by the next time they try to log in.

This can get annoying very quickly, especially on a time-sensitive site like eBay (where you are trying to win an auction), or even a stock-trading site.

You must be new here

[Anonymous Coward]

You're implying that slashdot members have a girlfriend, and then another to cheat on the first one with. HAHA

Best Practices..

[WHiTe VaMPiRe]

It has long been considered best practice to not identify that a user is valid in case of failure, as this can allow login harvesting. In case of privacy, I wouldn't necessarily disagree.

Sigh.

[TodMinuit]

You can try to fight this boogieman, but when you turn on the lights, he simply doesn't exist. You have woes-is-me arguments, nothing of substances.

Re:Sigh.

[Anonymous Coward]

And you're just a step above "If you don't like it, you can go be a hermit in the woods."

Re:Sigh.

[I(rispee_I(reme]

Currently awaiting a decent implementation of TCP/IP over evergreens.

Hmm, this could be useful...

[Anonymous Coward]

Step 1. Find a chick you want.
Step 2. Find her boyfriend's email address
Step 3. Sign him up for an account on a dating site that has weak authentication.
Step 4. Tell GF that you saw BF cheating, and drop a hint that he might have been trolling on that site; be there to console her.
Step 5. Profit!!!!

All your logins belong to us

[tedgyz]

Sorry

Re:All your logins belong to us

[tedgyz]

Crap! I messed it up. Yeah, yeah - preview. It should say:

All your logins are belong to us

Blush.

ACtually you shouldn't have signed the Ketubah

[alexhmit01]

Jewish contract law doesn't provide for signatures, because you can't assume literacy (Jewish contract law goes back at least 1600 years to the codification of the Talmud). The people that are supposed to sign the Ketubah are the witnesses. They witness that the man agreed to the terms of the Ketubah, and it is presented to the wife, whose acceptance (in front of Witnesses) creates the legal contract.

Now, Ashkenazi communities have used the same standard Aramaic Ketubah for centuries, but among some Sephardic communities, the Ketubah is still negotiated.

Jewish marriage is normally codified via contract, but can be established in three ways, sexual intercourse, being secluded with a member of the opposite sex and validly witnessed, or via contract. The former is frowned upon, and somewhat questionable because there are references in Jewish law to having sex outside the confines of marriage (not counting adultery), but since Jewish laws are so strict on sexual behavior without marriage, it was determined that sexual behavior is sufficient to form a marriage.

This may seem archaic, but some parts of the Israeli Rabbinate have made cohabitation be considered a marriage, and require a Get before permitting the woman to enter a marriage. This is extremely problematic for Kohanim, who aren't permitted to marry divorces.

Re:ACtually you shouldn't have signed the Ketubah

[i.r.id10t]

Actually, judiasm nearly requires literacy... after all, one is supposed to *read* the torah at bar mitzvah, not do it via route memorization like I did...

Re:ACtually you shouldn't have signed the Ketubah

[alexhmit01]

Rabbi Akiva, one of the greatest sages, was 40 years old, completely ignorant, and incapable of reading a single Bracha (blessing), before he went off to learn and become the greatest sage of his generation. Since Rabbi Akiva was married and encouraged to do this by his wife, we know that he obtained his Bar Mitzvah and was Married without any literacy whatsoever, yet he performed these lifecycle events.

Traditionally, everyone called for an Aliyah would read their portion, which would include a Bar Mitzvah boy. HOWEVER, when Jewish literacy declined and the sages were concerned that people couldn't read from the Torah and would be embarassed, they decreed that a single reader would read for everyone. When one is called to the Torah, one makes the blessing, and the reader reads the portion.

At a wedding, 7 blessings are read, supposed to be read by the groom. Again, what if you had an ignorant Jewish man, should he simply not be married? So the Sages decreed that a Rabbi should be at the wedding, and he should read the Brachot on behalf of the groom.

The exception to these rules is that a Rabbi is presumed to be literate, and therefore may read his own Aliyah or make his own blessings. It is assumed that he won't embarass everyone else because we know Rabbis are literate, with non-Rabbis, we'd never know like we should with some people.

The other section is the Maftir portion of the Torah reading, which technically isn't part of the Torah service (the required Aliyot for the day), but is done to tie in with Haftorah as we've already closed the Torah service with its Kaddish. This is why we sometimes (or in non-Orthodox circles, ALL the time), have the Bar Mitzvah boy read "his Aliyah" at the end, because Maftir is really short. If you go to an Orthodox shul for a while and observe Bar Mitzvah services, you'll see that some boys simply get an Aliyah and make the blessings, some make the blessings, read Maftir & Haftorah, some will read all the aliyot's portions, Maftir, Haftorah, plus Daven Mussaf.

The Bar Mitzvah is a celebration of adult hood. The father renounces his responsiblity for his son's sins, and the son takes his first opportunity to service in a minyan and it's public communal role. We do it on Shabbat for the same reason we announce upcoming Rosh Chodesh on Shabbat, or do a girl's naming on Shabbat, it's when we'll have the greatest attendence. Nothing prevents a Bar Mitzvah from happening at the Monday/Thursday Torah service, or on Rosh Chodesh, and in fact, we have those. If Rosh Chodesh falls on a Sunday, or Monday is a national holiday, or the Thursday of Thanksgiving, or any other reasons that make it easier to do a non-Shabbat Bar Mitzvah do so, you get a less crowded Sanctuary, people can drive, logistics are easier.

The child gets their first Aliyah and is called to the Torah. Doesn't mean that they are literate...

Re:Either you're together, or not, or you're open.

[hesiod]

> Not every fling deserves to be made known - sometimes people keep secrets from their partner because they love them

What a steaming pile! If they loved the person, they wouldn't f`ing cheat on them to begin with!!! WTF is with people trying to justify their disgusting practices with lies like that?

Because sites tend to confirm them...

[catbutt]

...by sending you a verification email you have to click a link in.

Re:Either you're together, or not, or you're open.

[twiddlingbits]

So you've never heard of swingers, open marriages, polygamy, polyandry, etc? Humans are one of the rarest of animals that does NOT have multiple partners. The only other animal I can think of that mates for life in the Canada Goose. There are theories that to preserve certain bloodlines in the Jewish nation was why Adultery was banned. I don't know if thats true. I try not to judge other people unless I'm sitting on a jury.

Correction: you're not your

[Browzer]

.
.
.
.

Answer? Try SpamGourmet.

[Kozz]

I've got to plug SpamGourmet.com. It's perfect for temporary throw-away addresses, like "slashdot.5.myalias@spamgourmet.com" which is my way of saying, "I've given my email address to a site called slashdot. They're only allowed to send mail to this address 5 times. After that, they bounce. The first five that make it through will be forwarded to an email address of my specification."

Of course there's the risk that a spammer would learn about spamgourmet and decide to exploit it by sending 115ASG123.20.myalias@spamgourmet.comm, but then they'd need to know my spamgourmet alias.

http://www.spamgourmet.com/.

Re:Either you're together, or not, or you're open.

[Anonymous Coward]

So you've never heard of swingers, open marriages, polygamy, polyandry, etc?

As far as I know, all of these are mutual agreements between two people. Cheating on someone would be having an extramarital affair/fling/whatever without their consent or knowledge. Most people feel that's bad because it betrays the emotional trust of the other person, not because of the "inherent sanctity of marriage". Of course the reasons that many people expect monogamy from their partners is cultural—but it's real, and if you're in a relationship where you don't intend to be "faithful", then you should let the other person know in advance.

who gets to decide?

[prgrmr]

[CT: We'd fix it if I thought it mattered]

This is a perfect example of the heart of the privacy issue: who gets to decide what is and what is not a matter of privacy, what information is "worth" privacy protection, what circumstances warrant privacy, and what does not.

You can bet that the answer the vast majority of corporate America is going to respond with is "we do".

Re:Either you're together, or not, or you're open.

[evil_Tak]

Please post your full name, so that we all know with whom to avoid entering a relationship.

Other methods to get this information

[WMSplat]

One method that is incredibly difficult to stop -- at least, sites are unwilling to do so -- is through timing the login page. By timing how long it takes to respond to an invalid login attempt (just use a bogus password), you can figure out if the username/email is valid at that site. Check out the paper on this called Exposing Private Information by Timing Web Applications at http://www.abortz.net/, which recently appeared at the IW3C2 World Wide Web conference this year.

Targeted Spam Lists? Why bother?

[Tipa]

Spammers don't care how many of the people in their spam email lists are actually members of Match.com or wherever. What's the point of checking each of 100,000 emails against Match.com when a spammer can just send the same spam to all 100,000 and automatically get the ones that happen to both be members of Match.com and unlucky enough to be spammed by them?

Re:Targeted Spam Lists? Why bother?

[Lehk228]

by running spam lists past member lists you can target your spam better. someone on dating sites can be spammed with porn and cialis ads while the guy on all the stock sites can be spammed with viagra and stock tips

Re:Either you're together, or not, or you're open.

[hesiod]

Heard of them? Hell, most of my friends fall into one of those categories. But like the AC said, the topic is "cheating." If the SO knows of the arrangement and approves, that is not cheating.

Verifications

[LunaticTippy]

My friend worked for an employment verifications company doing exactly this type of check. You could get a simple check for a few dollars, which was a criminal background and credit check. You could get employment or education verification, reference checks, etc. A top-shelf full verification ran hundreds of dollars.

I couldn't believe all the crap they found. People lied about all kinds of things on their applications and resumes. People lied about their criminal history, usually substituting something minor for a felony conviction.

I don't approve of the movement towards an Orwellian character investigation, but can certainly understand how a lot of businesses find it to be comforting. It is a very big market, and one that is growing rapidly. They ran checks for fast food workers to CEOs and everything in between, for a wide range of companies. Their biggest clients were financial and healthcare companies.

Maybe...

[Anonymous Coward]

You could be a respectable human being in the first place and not cheat.

There's a novel idea.

tl;dr

[jimbo3123]

Holy teal deer!

Could that article have been any longer?

Problem lies in a flawed assumtion

[Josef Meixner]

• Try to create a new account with that e-mail address. See if you get an error message saying the address is already associated with an account.
• Log in under an existing account, and try to switch to another e-mail address. See if you get an error message saying the address is already associated with an account.
• Use the forgot-your-password feature to request a password be sent to a given e-mail address. See if you get an error message saying that address is not associated with an account.

The first two points of the list are based on a very much flawed assumption by the applications, the problem to get a mail-address. The third is just plain stupid and leaks information.

Why are the first two flawed? They assume, that it is hard to get a second mail-address and therefore allowing only one account to be associated with an email-address somehow makes it harder for people to sign up multiple times. If that is not the reason, then the only other one I find is, to collect as many email-addresses as possible.

For me, there is no real reason, why an email-address can't be used multiple times. If you are afraid that someone signs up thousands of accounts, limit the number of signups per week. The probability that someone else trying to find out, if the address is being used hits one of the weeks where you signed up an account is much smaller.

Are these jokes still funny?

[Slashdot Parent]

I mean, In Soviet Russia came and went, the hot grits thing came and went, but for some reason, no one around here seems to get tired of reading the same, tired, "no one on slashdot can get a date!" jokes.

Oh, hell. Who am I kidding? I haven't had a date since my first kid was born. Nevermind.

Match.com have a duty to their shareholders.

[dwalsh]

1. Girlfriend finds out our victim is using Match.com
2. Girlfriend dumps our hero.
3. Hero must use dating agencies more to find new girlfriend.
4. Hero signs up for premium account, views more ads etc.

Clearly Match.com are doing what is their duty under capitalism!

Obligatory Business Plan

[PPH]

1) Get hold of the Goatse vistor's list.
2) Put it up for bid.
3) ????
4) Profit!

Mailman gets it right

[popeyethesailorman]

Mailman gets it right while pointing out this vulnerability. Attempt to subscribe to a mailman listserv when you're already a member and you'll see no error page. Rather, the real subscriber gets an email with subject Mailman privacy alert that reads

An attempt was made to subscribe your address to the mailing list . You are already subscribed to this mailing list. Note that the list membership is not public, so it is possible that a bad person was trying to probe the list for its membership. This would be a privacy violation if we let them do this, but we didn't. If you submitted the subscription request and forgot that you were already subscribed to the list, then you can ignore this message. If you suspect that an attempt is being made to covertly discover whether you are a member of this list, and you are worried about your privacy, then feel free to send a message to the list administrator ...

Happens IRL, too

[RealGrouchy]

Hey, you don't need the internet to have companies f*ck with your privacy.

How would you like it if your hotel gave your room key to a guy with a bunch of TV cameras?

- RG>

Bugmenot

[Anonymous Coward]

Yet another reason to use bugmenot. . .

Yahoooo etc

[Anonymous Coward]

Why would you use your mail email account for indifelity... google and yahoo can provide all your free email needs to assist in keeping your infidely from your significant other.

There's another angle to consider

[Whuffo]

If you were some sort of bottom-feeding scum with a big list of email addresses that you'd scraped from web pages - and looking to sell your list (profitable, and not risky) then you'd appreciate the difference between the price you'd get for raw addresses, or verified addresses.

Rather than launch a spam campaign and deal with the associated risks, why not just bounce your list off of a few high-traffic web sites to see if it's a valid login there? It's scriptable, doesn't cost anything - and the resulting list is much more valuable. If you're really lucky, the sites will offer other personal data as a "clue" to the forgotten password and you can plump up the list and make it even more valuable.

This is why Slashdot should care - if a login fails, no website should offer anything more than the fact that the login failed. No "bad password" or "invalid user id" - and definitely no "wrong password, click here and we'll ask you a personal question". Nothing more than "login failed".

More like how private AREN'T they.

[A_Scanner_Snoopy]

I once googled myself. I got nothing, but my uncle turned up. I clicked on the link--it was an Asian board game association, and I am curious naturally--and found several thousand other names. Not just the names, either--full contact information, like addresses, phone numbers, e-mail, etc.

Third Party Discolsure? A corporate perspective

[txelky]

Working in a large corporation that has an extreme amount of exposure, I can't help but think that soon....very soon...these sites will more than likely get slapped with a lawsuit. Reading and agreeing to a privacy policy is one thing, but I would personally be EXTREMELY upset if anyone ever disclosed my email address to someone without proof of identity. Stalkers of the world unite! As long as you have an email address, your heart's desire is within reach. Leaving a voicemail with too much info can even be considered excessive and grounds for breach of contract. This will be an interesting topic to keep your eyes on.

If you do understand the system...

[Browzer]

than at least you understand the chances of being caught, and then the question becomes a conversation about risk taking.

(I'm assuming you mean "if and only if", and that this isn't just a roundabout way of saying that anyone who's fooling around deserves to get caught.) No I didn't say that, but I would say anyone who doesn't understand the system AND fools around deserves (see below) to get caught or should not be fooling around in the first place. Originally I said nothing about people who do understand the system. But regardless if you do understand or do not understand the system, and if you do or you don't get caught, trust is still betrayed.

I mean "deserve" exactly in a non-moral sense. I mean "deserve" in a practical, non-hypothetical, non-religious sense, a form that involves lawyers, judges, loss of material objects, loss of privileges. I don't mean "deserve" in a ritual where one might be stoned to death, or one has say a few prayers, or made donate some money to an institution, and maybe some higher power will forgive your indiscretions.

ToSs it out

[oshii'sdog]

Does _anybody_ read the 4 or 5 page long Tos? And who has the time? There could be all kinds of nonsense in it! And for an experiment, probably the guys at Google might have already done this -> added terms like 'All my property will belong to Google after x time of having an account' in that huge document nobody cares to read.

EU Data protection law.

[julesh]

Interesting. I'd never considered that the use of e-mail addresses as a unique identifier caused information about a person to become publicly available, but it is pretty clear that it does.

I wonder how this sits with EU data protection laws, which make it illegal to reveal personal data about a third party as part of a business without that person's consent.

Re:Answer? Try SpamGourmet.

[Inda]

You can even stop the spam if the spammer finds your spamgourmet alias. You just pick a keyword that must form a part of every address. If the spammer works out your keyword (unlikely) then you just change it.

I love the service. I've loved it for years. It has blocked thousands of spam emails that have havested my address from slashdot. :)

funny how the mind plays tricks

[vernonB]

When I first read the excerpt in this article in the email digest, I read the example email address as blowjob@aol.com.

hundreds of paypal emails leaked

[jakeroberts]

Hello, I received an email today that was supposed to have information about my account in it. It instead contained hundreds of usernames and or emails. I have contacted paypal about this but received no response. I am trying to get the word out where ever I can.

Re:hundreds of paypal emails leaked

[jakeroberts]

The email does not contain any links or ask for any information. Just over 36,000 characters worth of email addresses.