Slashdot Mirror
How Much Is Your Gmail Account Worth To Crooks?
tsu doh nimh writes "If you use Gmail and have ever wondered how much your account might be worth to cyber thieves, have a look at Cloudsweeper, a new OAuth service launching this week that tries to price the value of your Gmail address based on the number of retail accounts you have tied to it and the current resale value of those accounts in the underground. From KrebsOnSecurity: 'The brainchild of researchers at the University of Illinois at Chicago, Cloudsweeperâ(TM)s account theft audit tool scans your inbox and presents a breakdown of how many accounts connected to that address an attacker could seize if he gained access to your Gmail. Cloudsweeper then tries to put an aggregate price tag on your inbox, a figure thatâ(TM)s computed by totaling the resale value of other account credentials that crooks can steal if they hijack your email.'"
A recent report from Kaspersky (PDF) also highlighted the trend toward phishing attepts targeting Facebook, Google, and Yahoo accounts alongside bank accounts.
"You're at risk!!! Download this scanning tool now to determine your chances of getting pwned." Where have I seen this kind of language before?
Now just let me hand over the keys to all my private mail to someone who will quickly be able to deduce how much it is worth.... /sarcasm>
Hmm, the humour and sarcasm seem to have been be lost on you.
Got locked out of that account and they basically want everything related to my identity to get it back (identity theft in order to return my identity) and now what, that's all my personal stuff that Google has access to, and I don't.
Sorry its 5pm on the east coast and time to go home so I didn't RTFA - anyone care to just give me the bottom line?
...will they be storing to mine?
People who bought "$5,000 offshore banking money transfer" also bought:
My Gmail account is not worth anything. Mainly because I never tied it to anything else, and I forgot the password years ago. Whoops. I don't like the Gmail interface, let alone the tied to Google aspect.
But if you could get a hold of my main email account... Actually, I still have no (or very few) other accounts tied to it. That's 'cause I give every service and website a different email address (slashdot.org.2013.06.26@example.org). So far I haven't discovered anyone specifically having sold or lost my email address, but I'm sure it's a matter of time.
What's the specifying Gmail for again? This is applicable to any email account isn't it?
HELP MY ACCOUNT HAS BEEN HACKED BY AN ILLIBERAL ART STUDENT SET TO DESTROY THE INTERWEBZ!
Hi! We just noticed the word, "SUCKER," printed on your forehead in big bold text, and thought you would be interested in our exciting new offer...
An enigma, wrapped in a riddle, shrouded in bacon and cheese
So I'm moving away from Google and Gmail. Can I sell my own account? And what kind of money can I get for it? Will it buy me a new Macbook at least? Then I might consider it! ;-)
10 million "theoretical dollars". Not to mention once the "cyber thieves" are able to "seize" all of my accounts, they could likely use my accounts as a spring board to bigger things. Perhaps even seize control of the nations power grid or the launch codes for our nuclear arsenal. Thank god I didn't click on that email about the package from FedEx I never ordered.
$28.50
Darn. I was hoping my gmail account would make me the next .com billionaire.
Do you manage all your accounts individually, or are they forwards? If the later, someone would only need the master account to reset passwords all over the place. Of course, a lot of more critical sites won't let you reset passwords that easily, but many do, and unless you're living in a vacuum, you probably have accounts on those too.
About tree fiddy
I ain't afraid but apparently it's not worth much anyway. If someone tried to steal my identity they'd end up worse off at this point :P
Der Tod ist der einzige Weg hier raus!
I have two gmail accounts and both of them are used for registering for websites which may have dubious practices, such as ... um ... /.
All anyone would gain from them is the ability to steal my password on review or nattering accounts, Comrade!
For limited time special offer to receive big quantity Order of Putin medals from Glorious People's Republic of Russia! Just you send 100 dollars USA or 3,000 Roubles to:
PO Box 786990
Chelyabinsk 211
Chelyabinsk Ob, Russia
A feeling of having made the same mistake before: Deja Foobar
Given that I'm sure if you tried enough, you could convince some moron working the phone at any of various financial establishments I have alerts sent from to let you draw money out of my accounts there, even though they shouldn't.
Other than that, I doubt it'd be worth very much, unless the crook *really* liked Kingdom of Loathing.
Why does amazon ( a serious competitor for Google Play) take it upon themselves to send an email showing the complete details of your transaction. Which Google can then scan and learn about Amazons customers and attempt to drive them to Google Play. It seems like all the web vendors want to give all their customer information to Google. Im sure Google appreciates the efforts on their behalf.
There should be very little detail in these transaction confirmations. And they should be optional. Or maybe SMS should be an option. But to give your competitor the names of your competition and what they like to purchase is just plain crazy to me.
Right now nobody knows how much my account is worth. If i allow this "tool" to scan my account, they create a metric of value where none existed before. I don't know what they do with that information. They probably sell it.
I do the same thing, but more like company@mypersonaldomain.com. I don't think that most companies sell or give away my email addresses, but they give lists to their MARKETING PARTNERS, which certainly do pass them on, or get hacked. I found this out by checking the to lines in spam and seeing united (airlines) and a CMS vendor. I also saw something from a company mailed to the email address associated with one of its competitors; from talking to people I found that a marketing person left the second and apparently took a contact list to the their new job at the first. It is a very worthwhile thing to do.
I just asked a crook what my GMail account is worth, he appraised it at at least 5 million US dollars. He charged 40$ for the estimation. It's good to know, now I have a reason to take extra steps to secure my account.
What about when you need to send a message, do you create a real email account for the organization then, or use a real account? I tend to use a real existing account when working with real people.
Don't use the same password for any two accounts. Second most important: don't use the same email address for any two accounts.
Another issue is that setting up a catchall/default increases spam. I get spam at addresses on my domain that I certainly never used; spammers seem to guess/make them up.
And another benefit - when you find an email address being used for spam, you can disable it, or worse.
That's why you make use of Google's relatively good tools to download all of your data regularly and make backups.
It's your data. You're the one responsible for it.
http://www.ismytwitterpasswordsecure.com/
I know it was made to check Twitter passwords, but it turns out that it works surprisingly well here too. In fact, it's smart enough to tell you how secure your passwords and accounts are, even if you enter fake credentials. I kid you not, it is that smart. Try it out.
If you're not using this for Gmail you're an idiot, especially if this stuff is tied to your bank.
SMTP is amazing, you can send an email from any email address. So, if my main email address is magic@maverick.com, and I'm having commercial mail sent to the domain manic.com, I just use the feature of my email client to make the send from address slashdot.org@manic.com (or whatever). And the way it's set up, all the fancy anti-spam measures (DomainKeys or whatever) still work!
Real people (who aren't working for an org) get my main email address (magic@maverick.com). On forms I write stuff like blahblah@manic.com or noreply@manic.com or even aiirapk2@manic.com. Or whatever. And I can then use those to communicate with people at whichever org it is.
Cool bananas.
HELP MY ACCOUNT HAS BEEN HACKED BY AN ILLIBERAL ART STUDENT SET TO DESTROY THE INTERWEBZ!
Does Google have a tool to backup Gmail data? Asking seriously, would like to use one. (I am aware that there are third-party tools and you can also download everything to your mail client yourself).
Coding etudes
They're already in there, anyway.
They can take my LifeAlert pendant when they pry it from my cold dead fingers.
most banks, broker's websites, and battle.net. These accounts worth $hitload more than paypal and amazon.
New Economic Perspectives
They provide access to the data, what more do you expect them to do? Now, if there were no 3rd party tools available, then I would be worried.
So, what exactly is Amazon supposed to do? Most people LIKE getting their transaction details sent to them; it's called a "receipt", and it serves as proof you bought whatever it is you think you bought, should this ever be up for dispute. Most people expect to receive a receipt for every electronic transaction, even if it isn't strictly necessary.
And the same thing could be said about any commercial e-mail service... nothing stops Mom-n-Pop ISP from mining your e-mail for data (or selling mining access to somebody who can.)
In any case, Amazon doesn't seem to be too bothered by the prospect...
If you don't trust GMail e-mail scanning, get your address elsewhere.
Use Pop3 and keep the server's inbox bare.
Granted, it's not a 100% solution. But odds are, if thieves scan your inbox and find nothing there, they won't be back.
Screw this IMAP stuff. It doesn't do anything I need and it leaves you vulnerable to this kind of attack.
I want a "real" copy in my own e-mail account, and I expect most other people do too. I don't want to have to go through all the hassle to obtain and save my own copy. What happens if your Amazon account is suspended? You'd never see those receipts again if you hadn't already saved a copy.