(OT) Did you get an email from me?

[Dustin]

Hi All.

I'd like to apologize for the email you may have gotten from me which
suggested you purchasing New Apple iPhone 4S 64GB – Black. I'd never send
you an email to suggest you buy anything, Especially an Apple product.

My google (gmail) account had been compromised on Thursday according to the
webmail details page. Google claims this occurred due to a spear phishing
campaign I and thousands (hundreds of thousands?) of other gmail users all
fell for. (If you don't buy that either, I don't blame you.) Unfortunately,
Google has been building a contact list for the webmail by harvesting email
address(s) being passed in transit from the smtp/pop3 transactions. In
other words, they're harvesting and storing it in your webmail account for
your convenience.

If you use gmail for smtp/pop3 and not webmail as myself (nor any other
google services), you may not be aware of this. I wasn't. Until yesterday.
I did not knowingly put anyones email address out there. I have since
changed the passphrase again, and removed everyone from this webmail
contact list. I will be checking the webmail interface to ensure it's no
longer creating any contact lists as I never agreed to such a thing and
really don't consider it a feature in the context in which I'm using Gmail.

I am very sorry this occurred and I have done what I can to prevent it from
happening again, atleast in so far as my abilities as a non Oper of gmail.
I take your email addresses and other aspects of privacy very seriously.

Thanks for your time!

Dustin Cook



--
Character is doing the right thing when nobody's looking. There are too
many people who think that the only thing that's right is to get by, and
the only thing that's wrong is to get caught. - J.C. Watts

[Beauregard T. Shagnasty]

Dustin wrote:

> ...
> Unfortunately, Google has been building a contact list for the webmail
> by harvesting email address(s) being passed in transit from the
> smtp/pop3 transactions. In other words, they're harvesting and storing
> it in your webmail account for your convenience.

That must only be happening to you. :-/ I just checked my two POP3 gmail
accounts, and there are no harvested/stored email addresses at the webmail
interface.

--
-bts
-This space for rent, but the price is high

[Dustin]

"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in news:jck05g
$g0b$1@dont-email.me:

> Dustin wrote:
>
>> ...
>> Unfortunately, Google has been building a contact list for the webmail
>> by harvesting email address(s) being passed in transit from the
>> smtp/pop3 transactions. In other words, they're harvesting and storing
>> it in your webmail account for your convenience.
>
> That must only be happening to you. :-/ I just checked my two POP3 gmail
> accounts, and there are no harvested/stored email addresses at the webmail
> interface.

LOL!.. Okay.




--
Character is doing the right thing when nobody's looking. There are too many
people who think that the only thing that's right is to get by, and the only
thing that's wrong is to get caught. - J.C. Watts

[Bullwinkle.]

20+ gmail accounts in the office and not happening to any.
dusty must be special.


"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in message
news:jck05g$g0b$1@dont-email.me...
Dustin wrote:

> ...
> Unfortunately, Google has been building a contact list for the webmail
> by harvesting email address(s) being passed in transit from the
> smtp/pop3 transactions. In other words, they're harvesting and storing
> it in your webmail account for your convenience.

That must only be happening to you. :-/ I just checked my two POP3 gmail
accounts, and there are no harvested/stored email addresses at the webmail
interface.

[Dustin]

"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in
news:jck05g$g0b$1@dont-email.me:

> Dustin wrote:
>
>> ...
>> Unfortunately, Google has been building a contact list for the webmail
>> by harvesting email address(s) being passed in transit from the
>> smtp/pop3 transactions. In other words, they're harvesting and storing
>> it in your webmail account for your convenience.
>
> That must only be happening to you. :-/ I just checked my two POP3
> gmail accounts, and there are no harvested/stored email addresses at the
> webmail interface.
>

Hi BTS.

I knew I wasn't imagining things, so I googled.

http://support.google.com/mail/bin/a...en&answer=8933

Gmail automatically adds addresses to your Contacts list each time you use
the Reply, Reply to all, or Forward functions to send mail to addresses
that don't already exist in your Contacts list. Each time you mark a
message as 'Not Spam,' your Contacts list is also automatically updated so
that future messages from that sender are received in your inbox. If these
addresses don't appear immediately, try waiting a few minutes or signing
out of your account and signing back in.

While they don't specify here whether or not smtp is affected, I do believe
it is as some of the email addresses could have only been acquired for
google via my email client; I simply don't do webmail. Don't like it, can't
trust your emails will always be there, rather keep them stored locally.

Hopefully the damn thing will honor my request to let me create my own
contact list.


--
Character is doing the right thing when nobody's looking. There are too
many people who think that the only thing that's right is to get by, and
the only thing that's wrong is to get caught. - J.C. Watts

[Beauregard T. Shagnasty]

Dustin wrote:

> "Beauregard T. Shagnasty" wrote:
>> Dustin wrote:
>>> ...
>>> Unfortunately, Google has been building a contact list for the webmail
>>> by harvesting email address(s) being passed in transit from the
>>> smtp/pop3 transactions. In other words, they're harvesting and storing
>>> it in your webmail account for your convenience.
>>
>> That must only be happening to you. :-/ I just checked my two POP3
>> gmail accounts, and there are no harvested/stored email addresses at
>> the webmail interface.
>
> Hi BTS.
>
> I knew I wasn't imagining things, so I googled.
>
> http://support.google.com/mail/bin/a...en&answer=8933
> <snip>

What you describe appears to be something that may happen if you are
using the gmail webmail interface. In your post, you stated they were
harvesting emails "in transit from smtp/pop3 transactions." There's a big
difference.

I read my gmail in Thunderbird, POPping and SMTPing through gmail as you
alluded, and there is no harvesting.

--
-bts
-This space for rent, but the price is high

[Rhonda Lea Kirk Fries]

Beauregard T. Shagnasty wrote:
> Dustin wrote:
>
>> "Beauregard T. Shagnasty" wrote:
>>> Dustin wrote:
>>>> ...
>>>> Unfortunately, Google has been building a contact list for
>>>> the webmail by harvesting email address(s) being passed in
>>>> transit from the smtp/pop3 transactions. In other words,
>>>> they're harvesting and storing it in your webmail account
>>>> for your convenience.
>>>
>>> That must only be happening to you. :-/ I just checked my
>>> two POP3 gmail accounts, and there are no harvested/stored
>>> email addresses at the webmail interface.
>>
>> Hi BTS.
>>
>> I knew I wasn't imagining things, so I googled.
>>
>> http://support.google.com/mail/bin/a...en&answer=8933
>> <snip>
>
> What you describe appears to be something that may happen if
> you are using the gmail webmail interface. In your post, you
> stated they were harvesting emails "in transit from smtp/pop3
> transactions." There's a big difference.
>
> I read my gmail in Thunderbird, POPping and SMTPing through
> gmail as you alluded, and there is no harvesting.

Under the general settings tab, there's an option to "Create contacts for
auto-complete." The choices are "When I send a message to a new person, add
them to Other Contacts so that I can auto-complete to them next time" or
"I'll add contacts myself."

I'm pretty sure that when I send to an new email address using Outlook
rather than the web interface, Gmail saves the address for me in my contacts
just as it does when I use the web interface. I'm equally sure that if I
were to change my selection, it would stop doing so, no matter the interface
I use.

But once someone has access to one's webmail account, it really doesn't
matter. One way or another, once the account is hacked, all the mail one has
sent and received is available for the use of the intruder.

Note to Dustin: I got one from your email address too.

[FromTheRafters]

Rhonda Lea Kirk Fries wrote:
> Beauregard T. Shagnasty wrote:
>> Dustin wrote:
>>
>>> "Beauregard T. Shagnasty" wrote:
>>>> Dustin wrote:
>>>>> ...
>>>>> Unfortunately, Google has been building a contact list for
>>>>> the webmail by harvesting email address(s) being passed in
>>>>> transit from the smtp/pop3 transactions. In other words,
>>>>> they're harvesting and storing it in your webmail account
>>>>> for your convenience.
>>>>
>>>> That must only be happening to you. :-/ I just checked my
>>>> two POP3 gmail accounts, and there are no harvested/stored
>>>> email addresses at the webmail interface.
>>>
>>> Hi BTS.
>>>
>>> I knew I wasn't imagining things, so I googled.
>>>
>>> http://support.google.com/mail/bin/a...en&answer=8933
>>> <snip>
>>
>> What you describe appears to be something that may happen if
>> you are using the gmail webmail interface. In your post, you
>> stated they were harvesting emails "in transit from smtp/pop3
>> transactions." There's a big difference.
>>
>> I read my gmail in Thunderbird, POPping and SMTPing through
>> gmail as you alluded, and there is no harvesting.
>
> Under the general settings tab, there's an option to "Create contacts for
> auto-complete." The choices are "When I send a message to a new person, add
> them to Other Contacts so that I can auto-complete to them next time" or
> "I'll add contacts myself."
>
> I'm pretty sure that when I send to an new email address using Outlook
> rather than the web interface, Gmail saves the address for me in my contacts
> just as it does when I use the web interface. I'm equally sure that if I
> were to change my selection, it would stop doing so, no matter the interface
> I use.
>
> But once someone has access to one's webmail account, it really doesn't
> matter. One way or another, once the account is hacked, all the mail one has
> sent and received is available for the use of the intruder.
>
> Note to Dustin: I got one from your email address too.
>
I didn't get one.

.... must be an oversight.

[Dustin]

"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in
news:jcm27i$l5f$1@dont-email.me:

> Dustin wrote:
>
>> "Beauregard T. Shagnasty" wrote:
>>> Dustin wrote:
>>>> ...
>>>> Unfortunately, Google has been building a contact list for the webmail
>>>> by harvesting email address(s) being passed in transit from the
>>>> smtp/pop3 transactions. In other words, they're harvesting and storing
>>>> it in your webmail account for your convenience.
>>>
>>> That must only be happening to you. :-/ I just checked my two POP3
>>> gmail accounts, and there are no harvested/stored email addresses at
>>> the webmail interface.
>>
>> Hi BTS.
>>
>> I knew I wasn't imagining things, so I googled.
>>
>> http://support.google.com/mail/bin/a...en&answer=8933
>> <snip>
>
> What you describe appears to be something that may happen if you are
> using the gmail webmail interface. In your post, you stated they were
> harvesting emails "in transit from smtp/pop3 transactions." There's a big
> difference.

Well, it's the only way I could think of where they had acquired the
specific list of email addresses. I cross referenced them with my email
client. Google has kept a very nice record of my account for me to peruse.
I didn't place these addresses in google intentionally, BTS. They did it
for me.

It's even contacted people I don't converse with.

> I read my gmail in Thunderbird, POPping and SMTPing through gmail as you
> alluded, and there is no harvesting.

I can provide no other explanation.




--
Character is doing the right thing when nobody's looking. There are too
many people who think that the only thing that's right is to get by, and
the only thing that's wrong is to get caught. - J.C. Watts

[Dustin]

"Rhonda Lea Kirk Fries" <rhondaleakirk@earthling.net> wrote in
news:9l7k9oFr2sU1@mid.individual.net:

> I'm pretty sure that when I send to an new email address using Outlook
> rather than the web interface, Gmail saves the address for me in my
> contacts just as it does when I use the web interface. I'm equally sure
> that if I were to change my selection, it would stop doing so, no matter
> the interface I use.

Correct as far as I have been able to determine. I just didn't know this was
happening. I setup the account years ago. Enabled smtp/pop3, bookmarked a
url to redo the password for security (every few weeks ya see) and didn't
look back. That was a bad move on my part.

> But once someone has access to one's webmail account, it really doesn't
> matter. One way or another, once the account is hacked, all the mail one
> has sent and received is available for the use of the intruder.

Fortunatly, gmail hasn't been storing copies of my incoming emails (that I
could see), but it was keeping copies of outgoing emails. Another feature,
useful it could be, but.. not to me.

> Note to Dustin: I got one from your email address too.

I am very sorry Rhonda, I have honored your no contact request for years.
This was out of my control.


--
Character is doing the right thing when nobody's looking. There are too many
people who think that the only thing that's right is to get by, and the only
thing that's wrong is to get caught. - J.C. Watts