The same threat actor has leaked larger amounts of data from LinkedIn dated 2023. They claim this new data contains 35M lines and is 12 GB uncompressed.
The jokes on LinkedIn. T-Mobile already has my social security number, birth date, and other important information on the dark web, thanks to their security breach.
I mentioned T-Mobile because I had gotten notification from AAA/ProtectMyID service that I was signed up for free after one of their breaches, that my information from the T-Mobile incident what was on the dark web. The scan service specifically mentioned T-Mobile.
But yeah you’re right, I knew also that Equifax had problems as well.
Strangely enough, that data doesn’t seem to have surfaced anywhere. There’s a decent chance it was stolen by a nation-state actor using it for espionage.
I have a set it up so that any email sent to unknown users on my domain gets redirected to email. If you send an email to [email protected] and my real email is [email protected], I will still receive the email.
Now this is great because I will just use [email protected] and still get the email. If the email is leaked, I will know where it came from.
Owning your own domain is great that way. Even makes the little bit I pay to ProtonMail well worth it. There are a few addresses I have dedicated, like my [email protected], me@, and my-name@, but the rest just go to a catch all. It’s fantastic.
I made that move and had no issues. You can copy/paste your way through DNS setup and the rest is just configuring your proton account how you want.
You’ll want to be familiar with proton and some of the tradeoffs in its privacy model, but it’s most likely more feature-full than a hosting provider. Dreamhost, for one, is quite basic.
out of curiosity do you have any theories why your domain/aliases got blocked?
For my domain it was put on a spam list that various ISPs use.
When I spoke with one ISP they said it’s because I had an open email address situation going, where a spammer can send a spam email out to a third party and on the reply address to they can make up anything as an email address for my domain name and it would be ‘valid’ because my domain email server was set up to receive all emails that you described.
And because of that I got put on a global spam list which many ISPs use. At the time I didn’t even know about my domain being on the list, I just noticed a big drop in emails I was receiving.
FYI this happened over a decade ago, so I do not know if that is the current practice today. But better to make sure any email addresses to your domain that is not valid does not go through. No “catch all” bucket situation.
That’s not because you have a wildcard. That’s because you need to implement DKIM, DMARC, and SPF records to prevent others from using your domain name to send mail.
MTAs use those standards to verify if somebody is permitted to send email for your domain. If you don’t have those set then you can get what that ISP described.
That’s because you need to implement DKIM, DMARC, and SPF records to prevent others from using your domain name to send mail.
Well I used a third party service to host my domain, and as far as I can remember (like I said this was over a decade ago, maybe almost two decades), everything was set up correctly at that time.
Not trying to dispute what you said, but I can at least speak towards that as far as we knew at the time we had the domain set up correctly on our end, the stuff we could control.
The only thing is we had a catch-all bucket setting turned on for emails to be forwarded to an internal email address of our domain.
I ended up just disabling the alias I use to receive emails from LinkedIn. Since I noticed I just kept deleting those emails without ever reading them, I figured I’d just opt to not receive any emails. :D
Nope, at one point I created a LinkedIn account and my email address immediately started getting spam.
I use unique emails for things. Technically, the emails don’t even exist, but I have a rule that any email that doesn’t exist will be forwarded to my actual account. So the made up email I used for LinkedIn was unique and had only ever been typed into the LinkedIn service.
I’ve been doing this for a while, and generally most things don’t seem to lose your email. There have been a few that were probably compromised, they were safe for a while then one day they were lost - this is more likely a malicious actor accessing the website’s database. However LinkedIn is one of only 2 websites I’ve signed up for that have instantly resulted in spam - the other was a porn website.
LinkedIn have always been shady as fuck. When they first started out, they convinced everyone to input their email login details. LinkedIn would then access your email account and send emails to all your contacts asking them to join - all coming directly from your email address, not theirs. That was how LinkedIn built its market share. Back in the MSN Messenger days, LinkedIn emails were pretty notorious, but also everyone was pretty carefree online. They were perhaps one of the first services to demonstrate that you really should be careful what you share online, even if it is a “legitimate” service. Not everyone learned that lesson.
The compromised email thing happend some time after the MSN Messenger days, and I admit that I was one of those gullible baffoons who fell for the login thing initially (I’ve had 3 LinkedIn accounts, my first, then the second which was unique but instantly spammed, then my current). I think the porn website was more or less around the same time as well, so it is possible that LinkedIn was compromised as well as the porn site, such that anyone who signed up for either service (and maybe some others) would instantly get added to a spam list - not by the service but by the malicious infection. However, it certainly would fit their MO for LinkedIn to just sell email addresses directly.
Nowadays, I do get emails to my current LinkedIn account email that clearly should not have been shared. These tend to be more focused on the industry I work in, instead of generic spam. Recruiters almost always contact me via messages.
Don’t give LinkedIn any more information than you have to. In particular, I would encourage users to share their CV’s off platform.
Thanks, it’s rare to find a well thought out answer in here like yours.
I agree that LinkedIn always did shady things to increase their user base. They used dark patterns to get access to your address book even as they got constant criticism for that, both externally and internally. One of their top product managers was actually proud of that, and said that they would have done more if possible.
But I very much doubt they actually sold their customer’s emails at any point. They have always been very protective of their customer’s data, fighting scrapers and limiting APIs. There’s no upside to selling your customers info. You’re undermining your own business by doing so.
and said that they would have done more if possible.
This there is the MO I was talking about.
I can’t conclusively say whether or not LinkedIn intentionally sold my email, or whether they were just infected at the time. However, I feel like the former is at least as feasible, and even if it was the latter it’s still reprehensible of them to be so lax in their security. Like I say, I’ve only experienced 2 websites that did that, and I’ve made up countless emails going on for years before then.
They don’t have lax security. They use industry standard measures, including encryption in transit and at rest, salted passwords (they were caught without salt over a decade ago and fixed it), internal training on security, phishing simulations, the works. Your data is their business, they don’t want to lose it.
“I’ll give this guy your name, contact info, and everything else I have about you, and I take no responsibility that he won’t call you in the middle of the night or visit your house. All good here, yeah?” - LinkedIn
Motherfucker, if LinkedIn were one of my friends, he’d get punched every time a recruiter contacted me despite me setting my options as “not looking for jobs atm”. I want you to point out the exact LinkedIn fuck whose job it is to get punched for this instead, please and thank you.
Wow, ok. Ignoring your apparent refusal to potential salary improvements, you can always turn off notifications, hibernate your account, close your account, or filter emails from LinkedIn, if it’s such a big deal to you.
Yeah it’s the only public social media I have with any personal information. If it leaks I’m fine with that because I use VPN and even have my email alias on there.
I’m not sure what you’re implying here regarding headers? Email is insecure regardless; even when using SMTP with TLS, it’s not like the headers are exposed whereas the body would be encrypted or something.
well with PGP, the header is unencrypted. But even with just smtp, the issue is simpler.
Putting it in the header makes it more accessible.
various emails could have the header “Is this you?”, and not all of them will hold a 2fa code, and even if they do, they may time out before you can find it and use it.
But if the email has the header: “Your secure 2fa code is 123456” from “[email protected]”
then unsurprisingly, logging into example.com with the user’s email and that 2fa code is going to be a breeze.
Is there a single large company that even sends PGP email?
logging into example.com with the user’s email and that 2fa code is going to be a breeze
Sure, IF 1. you already have the user’s password, and 2. a new code wouldn’t be required/the previous code invalidated when initiating a new login session?
Like, I’m not saying that 2FA codes via email is secure, but you’re implying that they are making a security hole via this - which I don’t see.
Unless you followed by installing gpg… then you failed. There are tons of uses for it, not necessarily encrypting emails (or more precisely, it kind of sucks at encrypting emails).
According to Troy Hunt this alleged leak is mostly from older leaks and fake data:
“this data is a combination of information sourced from public LinkedIn profiles, fabricated emails address and in part (anecdotally based on simply eyeballing the data this is a small part), the other sources in the column headings above. But the people are real, the companies are real, the domains are real and in many cases, the email addresses themselves are real”
Add comment