Slashdot Mirror
How Much Is Your Gmail Account Worth To Crooks?
tsu doh nimh writes "If you use Gmail and have ever wondered how much your account might be worth to cyber thieves, have a look at Cloudsweeper, a new OAuth service launching this week that tries to price the value of your Gmail address based on the number of retail accounts you have tied to it and the current resale value of those accounts in the underground. From KrebsOnSecurity: 'The brainchild of researchers at the University of Illinois at Chicago, Cloudsweeperâ(TM)s account theft audit tool scans your inbox and presents a breakdown of how many accounts connected to that address an attacker could seize if he gained access to your Gmail. Cloudsweeper then tries to put an aggregate price tag on your inbox, a figure thatâ(TM)s computed by totaling the resale value of other account credentials that crooks can steal if they hijack your email.'"
A recent report from Kaspersky (PDF) also highlighted the trend toward phishing attepts targeting Facebook, Google, and Yahoo accounts alongside bank accounts.
"You're at risk!!! Download this scanning tool now to determine your chances of getting pwned." Where have I seen this kind of language before?
Now just let me hand over the keys to all my private mail to someone who will quickly be able to deduce how much it is worth.... /sarcasm>
Hmm, the humour and sarcasm seem to have been be lost on you.
I don't have one.
Got locked out of that account and they basically want everything related to my identity to get it back (identity theft in order to return my identity) and now what, that's all my personal stuff that Google has access to, and I don't.
Sorry its 5pm on the east coast and time to go home so I didn't RTFA - anyone care to just give me the bottom line?
Who's gaining access to your GMail account again?
...will they be storing to mine?
People who bought "$5,000 offshore banking money transfer" also bought:
I can't wait till everything implodes and all we have to worry about again is how and what we are going to eat.
My Gmail account is not worth anything. Mainly because I never tied it to anything else, and I forgot the password years ago. Whoops. I don't like the Gmail interface, let alone the tied to Google aspect.
But if you could get a hold of my main email account... Actually, I still have no (or very few) other accounts tied to it. That's 'cause I give every service and website a different email address (slashdot.org.2013.06.26@example.org). So far I haven't discovered anyone specifically having sold or lost my email address, but I'm sure it's a matter of time.
What's the specifying Gmail for again? This is applicable to any email account isn't it?
HELP MY ACCOUNT HAS BEEN HACKED BY AN ILLIBERAL ART STUDENT SET TO DESTROY THE INTERWEBZ!
Hi! We just noticed the word, "SUCKER," printed on your forehead in big bold text, and thought you would be interested in our exciting new offer...
An enigma, wrapped in a riddle, shrouded in bacon and cheese
So I'm moving away from Google and Gmail. Can I sell my own account? And what kind of money can I get for it? Will it buy me a new Macbook at least? Then I might consider it! ;-)
10 million "theoretical dollars". Not to mention once the "cyber thieves" are able to "seize" all of my accounts, they could likely use my accounts as a spring board to bigger things. Perhaps even seize control of the nations power grid or the launch codes for our nuclear arsenal. Thank god I didn't click on that email about the package from FedEx I never ordered.
$28.50
Darn. I was hoping my gmail account would make me the next .com billionaire.
About tree fiddy
I ain't afraid but apparently it's not worth much anyway. If someone tried to steal my identity they'd end up worse off at this point :P
Der Tod ist der einzige Weg hier raus!
I have two gmail accounts and both of them are used for registering for websites which may have dubious practices, such as ... um ... /.
All anyone would gain from them is the ability to steal my password on review or nattering accounts, Comrade!
For limited time special offer to receive big quantity Order of Putin medals from Glorious People's Republic of Russia! Just you send 100 dollars USA or 3,000 Roubles to:
PO Box 786990
Chelyabinsk 211
Chelyabinsk Ob, Russia
A feeling of having made the same mistake before: Deja Foobar
Given that I'm sure if you tried enough, you could convince some moron working the phone at any of various financial establishments I have alerts sent from to let you draw money out of my accounts there, even though they shouldn't.
Other than that, I doubt it'd be worth very much, unless the crook *really* liked Kingdom of Loathing.
Why does amazon ( a serious competitor for Google Play) take it upon themselves to send an email showing the complete details of your transaction. Which Google can then scan and learn about Amazons customers and attempt to drive them to Google Play. It seems like all the web vendors want to give all their customer information to Google. Im sure Google appreciates the efforts on their behalf.
There should be very little detail in these transaction confirmations. And they should be optional. Or maybe SMS should be an option. But to give your competitor the names of your competition and what they like to purchase is just plain crazy to me.
Right now nobody knows how much my account is worth. If i allow this "tool" to scan my account, they create a metric of value where none existed before. I don't know what they do with that information. They probably sell it.
I just asked a crook what my GMail account is worth, he appraised it at at least 5 million US dollars. He charged 40$ for the estimation. It's good to know, now I have a reason to take extra steps to secure my account.
Don't use the same password for any two accounts. Second most important: don't use the same email address for any two accounts.
That's why you make use of Google's relatively good tools to download all of your data regularly and make backups.
It's your data. You're the one responsible for it.
Result: my account is worth a staggering $ 0.60 to potential thieves ;-)
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
http://www.ismytwitterpasswordsecure.com/
I know it was made to check Twitter passwords, but it turns out that it works surprisingly well here too. In fact, it's smart enough to tell you how secure your passwords and accounts are, even if you enter fake credentials. I kid you not, it is that smart. Try it out.
If you're not using this for Gmail you're an idiot, especially if this stuff is tied to your bank.
But I will tell you anything you want to hear for $100 in bitcoin.
Does Google have a tool to backup Gmail data? Asking seriously, would like to use one. (I am aware that there are third-party tools and you can also download everything to your mail client yourself).
Coding etudes
They're already in there, anyway.
They can take my LifeAlert pendant when they pry it from my cold dead fingers.
most banks, broker's websites, and battle.net. These accounts worth $hitload more than paypal and amazon.
New Economic Perspectives
They provide access to the data, what more do you expect them to do? Now, if there were no 3rd party tools available, then I would be worried.
do they want stupid power point presentations with pron that usually my friends send me?
So then how could it be worth anything?
Seriously though, if I have no price on that account now, then why would I need to know the price that crooks would put on it? It seems a little bit crazy, because if you look at the same idea, but with another "object" (rather than gmail accounts), like, say, your daughter's vagina...
"How much is your daughter's vagina worth? Drive her over here, let us 'install a temporary tool' in her vagina. We check for bacteria levels, tightness, depth and overall smell/taste, while also checking pupil dilation as we stroke her clitoris. Afterwards, we provide you with a price that a goon would pay to rape her."
A bit weird, eh?
my $.02
So, what exactly is Amazon supposed to do? Most people LIKE getting their transaction details sent to them; it's called a "receipt", and it serves as proof you bought whatever it is you think you bought, should this ever be up for dispute. Most people expect to receive a receipt for every electronic transaction, even if it isn't strictly necessary.
And the same thing could be said about any commercial e-mail service... nothing stops Mom-n-Pop ISP from mining your e-mail for data (or selling mining access to somebody who can.)
In any case, Amazon doesn't seem to be too bothered by the prospect...
If you don't trust GMail e-mail scanning, get your address elsewhere.
Use Pop3 and keep the server's inbox bare.
Granted, it's not a 100% solution. But odds are, if thieves scan your inbox and find nothing there, they won't be back.
Screw this IMAP stuff. It doesn't do anything I need and it leaves you vulnerable to this kind of attack.
I want a "real" copy in my own e-mail account, and I expect most other people do too. I don't want to have to go through all the hassle to obtain and save my own copy. What happens if your Amazon account is suspended? You'd never see those receipts again if you hadn't already saved a copy.
Seriously, am I the only one who displays the order and does a print screen to PDF immediately after the purchase? Seriously? Is that so hard?
I have 10+ years of these, still less than 1 GB.