As part of a large-scale privacy investigation, I have bought more than 100 domain names previously belonging to social welfare and justice institutions in Belgium. What I observed was unsettling.
You must log in or register to comment.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 2.44K Posts
- 57.6K Comments
- Modlog
This honestly depressed me, I know firsthand many people who need help from someone who has more or less knowledge to understand something as simple as the migration of a service or an email, it is really depressing not only to know that this happens, but also that There are people who are such bastards that take advantage of this.
Could someone explain to me how the author gained access to “I forgot my password” accounts that were not his but were in his domain? I mean, I understand that it’s on his domain, but just because I have the domain mydomain@domain.com does that mean I can redirect all emails to the main domain? Excuse the dumb question.
Edit: Thanks for the clarification! Now I understand!
What you’d buy is “domain.com” and can then redirect any emails of the form “<anything>@domain.com” or even things like “<anything>@<anything>.domain.com”.
In fact, any email ending in “.domain.com” or “@domain.com”. And you could set up a wildcard to catch all emails without having to setup that specific email first.
I think you are a bit confused about the E-mail structure.
Everything behind the @ is the domain, on your case “domain.com” Before the @ is just a name that can be used as you, the domain owner, wants.
If you want to redirect all mail to yourname@domain.com, that’s very easy to do AND you can still see the original e-mail address these nails were sent to.
So I assume for example Dropbox sent some commercial mail about current offers. Using that, he knew the old account and that it was signed up to Dropbox
And it’s a great way to see who’s leaking your email to spammers…
Yes, if you have a domain you can catch all emails being sent there even if you don’t know the name - having the domain means controlling the bit after the @, so every email address with that ending.
the domain is fifi.com,the dropbox account is office@fifi.com, the fifi.com expires and after 2 years you buy it you go to dropbox and you click forgot password, then you input the email address. if the email address had and account then you receive input such as link has been sent to you. there. done.