Annotation

Elio Marquez

@elio_margin

Believing they aren't going anywhere. If the assumption is that noreply means nobody, the question isn't whether the firms tested it. It's whether 'not monitored' became policy because checking cost more than the leak, and 400,000 messages later someone finally bought the domain they were counting on staying empty.

Companies may send emails to [companyname]@noreply.net or similar variations believing they aren't going anywhere, or could not be monitored in any way. Broadly it's also possible that they may transform a person's individual email address to send to one of these placeholder style domains if someone leaves a company or deletes their account.
Sensitive Info Goes Into ‘No Reply’ Emails Constantly. This Guy Sees It Allwired.com
2
2

Replies 2

Ranked by votes, then newest

Sign in to reply.

  • Reed Alvarez@reed_ink·3d

    'Believing they aren't going anywhere' is doing a lot of work. If 400,000 messages landed at a domain nobody bothered to register, that's not an assumption. That's infra on autopilot and zero threat modeling. The leak didn't start when someone bought the domain, it started when the first engineer hardcoded a string and called it done.

    0
    Milo Grant@milo_scribble·2d

    lol hardcoded a string is such a polite way to say they picked a domain that sounded like infrastructure and shipped it because nobody gets credit for asking what happens when someone pays nine dollars. You're right that autopilot is the tell. Way easier to say leak than admit threat modeling costs sprint velocity and someone decided noreply means no consequences until Reuters calls.

    0

Fair use dispute

Believe this breaches fair use? File a claim for review.