DocuSign email address database breached and used for phishing campaign
I would like to urge the Google team to solve one aspect of this problem, forever.<p>It takes no more than 20 minutes to prototype and then approximately 1 day to fully test the final solution that is necessary on their end to keep compromised emails from being fully compromised addresses forever, without any chance for you to ever know at any point in the future where mail REALLY comes from.  Here is a description:<p>1 - Currently they (Google) correctly do 99% by allowing you to type a + after your email address to create a new inbox that is marked in a special way.  For example if your address is jsmith747@gmail.com then you can give the company jsmith747+docusign@gmail.com when you sign up - that inbox goes to you and when you start receicing spam in the future to &quot;jsmith747+docusign&quot; you can tell how they got it.  The phishing mails associated with this breach would have gone to the same place.<p>2.  The one and only problem with this, which currently has a &quot;security through obscurity&quot; solution, is that anyone can run a regex and remove +docusign to get at the primary, main inbox: jsmith747@gmail.com<p>3.  The full and complete solution is to allow me to create a new inbox in Gmail through a single step, for example &quot;j45rsdfjdocusign&quot; which is linked to jsmith747 in a single direction.  Sending mail is not necessary.  This must be enabled through the Gmail interface for signed-in users who wish to create a new inbox.  They must be able to generate an inbox there, which thereafter goes to the inbox.<p>4.  Spammers have no way to programmatically get the original underlying address when going through a list.  When they get to j45rsdfjdocusign there is no regex they can apply to get the original.<p>5.  If in the future j45rsdfjdocusign starts getting spammed, etc, you can add a filter.<p>There&#x27;s no special authentication around it, anyone signed into their inbox should be able to do do it.  They already have the infrastructure up for it around their + coding shceme.<p>To emphasize how important it is, here is a comment from this thread:<p>&gt;The phishing emails had the color scheme changed, making them very phony and easy to classify.<p>Today.  Under the current status quo, if in 48 months a much more legitimate-looking mail is sent to any of the same addresses, none of the recipients have any way to know the source of those addresses.<p>However, after solving this security issue, in 48 months anyone receiving even a very convincing phishing email could know instantly &quot;oh, that is that compromised docusign account&quot; -- that is, if they haven&#x27;t taken a moment to redirect that inbox to the trash already via a filter.<p>I urge Google, who has very talented engineers, to implement the correct solution today.  Don&#x27;t wait.  You won&#x27;t get a better example of how important this is, than what&#x27;s been going on.  There are no policy implications as you already do it via the + trick.<p>I hope you go the extra mile and add a small step to finish solving the problem.  Thank you.