Nick100

Just thought I would highlight a security issue I came across this week. I was horrified and it got me thinking. Anyone else had any experience of this ?

Bit of background : I had broadband installed at home in December - with freedom2surf (f2s). It comes with a standard email address, but the option to add up to 20. I thought I would add nick100 at f2s.com, but it wasn't available, so I chose a few others instead. Last week, I thought "Did I try nick100 ?". I couldn't be sure, so tried to register it and sure enough it was available. It's only since then, that I'm now sure I tried it originally.

So I set up my new account on Outlook Express last night and first connection gets me 750 emails !! WTF

It appears at least 2 people have used this address previously and presumably have stopped using f2s, so the address has been freed up again. One guy called Nick (seems reasonable), the other called Brian The problem has arisen because they have obviously registered with all sorts of sites for info (hence loads of junk email) and used the address for some other more important things as well.

I went through all the emails by block (ie. 10 emails from motley fool, 20 from dial a phone etc.) hit unsubscribe to unregister for all the junk. Deleted a few of the more dubious emails offering pills for various afflictions - I assume these were just sent to random email addresses and had not been requested Then I find a few with more sensitive information.

So I've now got emails for Brian from ebay (nice pair of shoes he was bidding on ), which confirmed his bank account details , Paypal giving account info, home address confirmations, place of work, phone numbers etc. This info is only going in the bin, since I am a very honest person (...honest !), but the potential for identity theft, bank account theft etc is huge if this had fallen in to the wrong hands.

The worst one was Tesco. Having hit the unsubscribe button, it took me to the website and wanted me to log in, but I needed a password. It also gave me the option to email the password to me (but for security reasons this could only be sent to the registered email address - now mine ). So I requested the password so I could unsubscribe. Trouble was that also gave me home address and phone info.

As I said, I was shocked to find all this. It had never occurred to me the need to ensure you unregister your email address with all websites if you abandon it.

I did wonder whether to phone the guy and tell him what I had found, to email it all to him at this new email address (also apparent from the info), or to take it to the police. If I keep getting too much junk that I can't stop, I may abandon the email address anyway.

Any thoughts or advice ??
Cheers
Nick

class_A

You're saying you managed to register an account, presumably marked as "dormant" and create a new password for it which also allowed you access to any mail sent to that address when it was previously not "dormant"? You appear to have found a rather lame email admin and/or a bug in their system. I would email tech support for the ISP concerned.

douglasb

I've had something similar.

When I set up an account with freeserve I was asked to name my own domain (so that the eventual email address looks like myname@mydomain.freeserve.co.uk). This allows you to set up an unlimited number of email accounts and set up rules so that mail to cricketclub@mydomain.freeserve.co.uk goes to a different folder from mail to myname@.....

The domain name that I chose also appears to have been dormant (I think Freeerve's rules were that if you don't use your account for either 3 or 6 months they will make it dormant). As soon as I set up my mail account I was swamped with loads of emails for andrew@mydomain.freeserve.co.uk. Nothing appeared to be confidential but every day there would be another dozen or so mails for this guy.

Eventually, I set up a rule in Outlook Express to delete from the server any mails to that address.