http://www.schneier.com/blog/archives/2011/04/epsilon_hack.html

Schneier on Security
A blog covering security and security technology.

April 5, 2011
Epsilon Hack

*** begin quote ***

I have no idea why the Epsilon hack is getting so much press.

Yes, millions of names and e-mail addresses might have been stolen. Yes, other customer information might have been stolen, too. Yes, this personal information could be used to create more personalized and better targeted phishing attacks.

*** end quote ***

You should shift to your own domain. Sorry, but yahoo, gmail, and hotmail make you a sitting duck for this hack.Your own domain just moves you out of the target zone.

Alpha spammers just keep trying every id from AA@yahoo.com to ZZZZZZZZZ@hotmail.com and then they turn around and repeat.

So you get “MYDOMAIN.COM”. (You can even push all the email to GMAIL for free.)

Then you create a spreadsheet or use a tool like LASTPASS, ROBOFORM, or such.

Now you assign email addresses to your correspondents. And, add a magic random string to the name, like, k7sa yk2k3 ggfn a2zq

Best Buy ==> BestBuy_k7sa @ MYDOMAIN.COM
Target ===>  Target_yk2k3  @ MYDOMAIN.COM
Verizon ===> Verizon_ggfn  @ MYDOMAIN.COM
Walgreens ==> Walgreens_a2zq @ MYDOMAIN.COM

You can then write email filters that will quarantine emails that arrive without the proper address.

If Best Buy messages come without the “k7sa”, you know that it’s not the address that you gave them.

If non-Best Buy messages come in with the “k7sa”, you know that it’s a compromised email address.

Go change your address at Best Buy and write a filter to trash any “k7sa” email.

It’s just like having unique passwords for all accounts.

# # # # #