dropbox. meh. yet another company not taking responsibility for their security breaches. at the very least, their email list has been compromised and they're sloughing it off as something that happened nine months ago.

whenever i establish a relationship with a vendor who requires an email address from me, i give them an email address unique to just them. i give that email address to no-one else and, in most circumstances, i will never send an email _from_ that email address.

that is exactly what i did with dropbox.

i signed up for a dropbox account almost a year ago, on march 21, 2012. i immediately received the standard "welcome" email. over the course of the next nine months i received exactly three additional marketing-type emails from them.

then i started getting spam/phishing emails. on 19-feb-2013 i received an email saying my direct deposit had been disallowed; on 26-feb-2013 i received an email indicating new security was being put in place for ACH and EFT transactions; and on both 27-feb and 28-feb-2013 i received an email asking me to join a linkedin account. all four emails were phishing emails.

since i have never shared that email address with anyone, since i had never sent any email _from_ that address, and since the emails were all phishing emails, then one of three things has happened:

- dropbox sold, gave away, or otherwise shared my information with one or more dubious with parties.

- someone hacked dropbox's systems and stole my information.

- dropbox has one or more rogue employees who is using customer information for their own benefit.

they say that it's because of a breach they had in july of 2012 but i find that hard to believe ... i don't think the spammers would wait nine months to start sending me spam, and i don't fall into either of the two categories that the dropbox blog entry says their compromised users fall into. and they say that only after weeks of badgering them to get a response.

dropbox. meh.

I understood spammers make up email addresses. No problem that many or most won't exist, they just bounce. Any that don't are thereby validated and added to their list for repeated use.

If you have the means, check for email sent to non-existent users email addresses at your domain, you'll find there there's plenty for all sorts of made up users that you never gave to anyone.

   I have a Dropbox account linked to an email created just for such occasions (NOT gmail).  It's used for a handful of other services as well and never sees much spam and never had a phishing email in a year and a half.   Barely ever anything there except what's supposed to be.  Google, Facebook and Yahoo make any DropBox security issues look like peanuts.  

Quote:

Originally Posted by Pooch 

i don't believe it's a good guesser that caused me to start getting spam at this address, i believe it's a dropbox security issue.

My primary email address has been on the Internet since 1994. I never get spam. No one at our company gets any spam because we use a commercial spam filtering company, MX Logic. We have our own DNS and mail server but the MX records point to mxlogic.com. They filter it and send back to us. The firewall only receives SMTP from them.

Much easier than than trying to manage it yourself.

Quote:

Originally Posted by SolipsismX 

much like the "@" character forms the boundary between the local-part and domain.

I just wish they could figure out how to fix the domain address.

You know how in the US they refer to the date as MM/DD/YYYY when in the rest of the world it is DD/MM/YYYY. At least that makes some sense since it goes from smaller increment to larger, however it probably should be YYYY/MM/DD like in computer systems. But when domain names were invented they were expressed by subdomain.domain.tld when actually they would be far more logical if they were constructed in reverse as tld.domain.subdomain so that things could be sorted alphabetically. That is why you see it in bash commands for example com.apple.bluetooth.plist. They had the chance to fix it before the opposite wrong format became so widespread that it would disrupt the Internet to change it.

in your example, com.me.solipsismx.mail would be your email address. Organized from general to specific would be better than the inverse but it will probably never happen.