boakes.org

Sequential Email Addresses are Silly

A simple hint for email administrators everywhere. If you have a large number of users with unique sequential ID numbers, it may be tempting to use that ID as a primary email address, or an alias, but don’t do it. It’s an open invitation to spammers to target your users with the minimum of effort. Once they know one number in the sequence they can quickly find two more addresses by adding or subtracting from the first. Before long, with kinderarden maths they’ve guessed every email address and can proceed to spam them all. Today, I was automatically registered for one of Portsmouth Uni’s Google Apps accounts. It comes complete with an email address that is sequentially numbered. As a consequence, having never sent a mail with the account, and having never logged in until today, I found in my inbox, five, beautiful blinking pieces of spam. Years ago when we were setting up the email addresses for vodafone.net, the powers that be in Vodafone were really keen to have your-phone-number@vodafone.net as the email address format. We advised against it, strongly. We did sharp intakes of breath. We did furrowed brows. We did reverse psychology. Everything. The light was seen, and sanity and happiness was maintained, at least for a few months, then they did it anyway. I wonder how those vodafone.net accounts are doing now.