9

I have my own domain (lets call it MyDomain.com), and my email account is set up such that all mails sent to @MyDomain.com will end up in the same mailbox.

So, think of a word, put it in front of @MyDomain.com, send me an email, and I will get it.

When I sign up for SomeService.com, the email address I will give them is ‘someservice@MyDomain.com’.

This means that if I get a spam email sent 'To' someservice@MyDomain.com, I can identify 'someservice' as having compromised my email address...Or so I thought.

When catching a company (a pharmacy from whom I'd bought earplugs), as far as I was concerned, red-handed, I sought them out, and got the following response:

I am one of the webmasters of the [SomeService] commerce portal. We take user data security very seriously as our business depends on this.

We have been PCI certified by 2 independent agencies who routinely scan our systems for security flaws.

Emails can leak out at multiple levels including the users computer or in transit due to network sniffers that are increasing being employed by professional spammers.

We not only keep our systems behind a firewall but also encrypt user data to ensure privacy even from our own staff.

I reiterate this is not something we condone and we will do an internal investigation to ensure our systems are clean. Kind Regards [administrator]

What do you folks make of this? Some questions I'm asking are

  • What is PCI certification and can I take this seriously/is is credible?
  • Is the 'email-leaking' and 'network sniffer' claims credible?

And any thoughts in general. Let's just say I'm learning.

Thanks, James

Improve this question
  • How do you mean you can identify 'someservice' as having compromised your email address? Do you keep a record of every 'someservice@' email address you have used? – Connor W Sep 20 '10 at 18:34
  • Yes, I do. I'm currently up to about 20. And even if I didn't, receiving an email like this would jog my memory. :-) – James Wiseman Sep 20 '10 at 18:43
  • 2
    @ Connor Surely the record is in the 'someservice' part. One would sign up to "stackoverflow" with an address of "stackoverflow@mydomain.com" and use that email address for nothing else. The question is, if one gets spam addressed to "stackoverflow@mydomain.com" where has the spammer got the address from if not from "stackoverflow"? – Neal Sep 20 '10 at 18:47
  • 2
    Some spammers look for registered domains and then try to make up addresses from dictionaries so there is another way to get spam. Still, if that was the case, it would have been envious is setup such as the one OP described. – AndrejaKo Sep 20 '10 at 18:55
  • 1
    I do this too and it works great. I have only had one instance of a third party actively giving an address to spammers. It was apparently a result of sending in rebate forms for a popular electronics store. That address is now blocked. – Chris Nava Sep 20 '10 at 19:03
7

PCI certification probably relates to PCI Security Standards Council, which is mostly about Payment Application Data Security, rather than email security. In short: No relation to your request.

As regarding sniffers on your local network, I really don't think that anybody went to trouble of connecting to your home in order to get your email addresses. So again: Not related to your question.

A firewall is not an ultimate protection, since it may have unplugged security holes, and it anyway passes emails which may convince employees to install spyware behind it on the internal network, which then becomes wide open to the hacker.

Encrypting user data is nice, but a virus can always intercept the email before it was encoded.

Conclusion: This is a high-and-mighty blah-blah whose purpose is to hide that the guy doesn't have a clue as regarding security. Don't trust them, they might be full of viruses and still naively fully confident of their firewall.

For protecting your email, I suggest to have a look at e4ward. It has free or paid accounts (only $10 a year) and allows much better control of your email, since it lets you cut-off such guys.

Improve this answer
3

PCI compliance is a data security standard used by those who handle credit card data. It is certainly possible to harvest email addresses in a variety of ways. Whether and how often this is done over the wire is the question. The response doesn't address whether they sell their email addresses. You should be able to obtain their privacy policy on their web site or by request and it should cover this issue. Also, it might be possible for an insider to harvest addresses (I don't know how PCI deals with this possibility).

Improve this answer
  • 4
    PCI has nothing to do with email security. I was manager at a POS vendor dealing with a LOT of PCI issues until earlier this year, and I have (unfortunately for me) read the docs and standards pretty thoroughly. – JNK Sep 20 '10 at 18:53
  • I should have also noted that pharmacies in the US are subject to data privacy regulations that have nothing to do with PCI. I know they apply to prescriptions but I don't know if they apply to other business dealings. – Dennis Williamson Sep 20 '10 at 20:35
3

As the other answers have said, PCI is all about security of the server / service, and not about personal data.

I think the most likely answer is that you are simply unlucky.

I also run a catchall email address on my server and I get thousands of spam each day - these people simply guess combinations of addresses. It is nothing special and the longer you own the domain, the more spam will come your way.

Although, that being said, you can't rule out that this place gave your email address away, but if it is a big place you have to ask yourself, is it really in their best interest to do so.

If it is genuine bulk, unsolicited spam such as garbage email with one attachment or Viagra adverts, it is unlikely to have come from a sold list.

Improve this answer
  • Cheers Wil. I've owned the domain for 8 years now, and get a large quantity of spam, virtually all of which is diverted into my spam folder. I'm actually delighted that a method I have used has worked. It's not a big place, and I wouldn't be surprised if this made it a nice extra revenue stream. – James Wiseman Sep 21 '10 at 7:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.