800M Email Addresses Leaked Online by Email Verification Service
I strongly believe that we should be keeping our email addresses as secure as our passwords. It’s a really important attack vector as it’s often the starting point for any targeted attack, and although it’s not usually considered as a factor, it is the 2nd factor required for most logins (email and password). Triggering important security processes (eg reset password, social engineering attacks) are trivial once you know someone’s email address.<p>It’s clear from this hack that the owners of the hacked site didn’t see emails as something worth securing (stored in plain text on a wide open mongo server)<p>If you want to keep your email address private (you should), generate a new, random email address whenever you give yours out (the same way you use a password manager). If you have your own domain you can use a catch all/wildcard address, eg. *@mydomain.com, if you use gmail you can use their plus support, e.g. John+uniqueidentifier@gmail.com, if you use neither or want more security I’ve recently launched <a href="https://idbloc.co" rel="nofollow">https://idbloc.co</a> which aims to help deal with this.