# What can people find about me from just my email address? **URL:** \ **Category:** Factual Questions\ **Created:** [July 24, 2013, 8:56pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416 "2013-07-24T20:56:51Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![Tanhauser\_Gate](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@Tanhauser\_Gate](https://boards.straightdope.com/u/Tanhauser_Gate)\ **Post date:** [July 24, 2013, 8:56pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/1 "2013-07-24T20:56:51Z")
I listened to a podcast today which gave me pause… the guy was talking about “social engineering”, how it’s possible to get information on people just based on their email and some other scant pieces of information. Apparently that’s how Scarlet Johanson’s pictures were leaked–she’d left a bunch of information online like the name of her pet, what high school she went to, etc, and a hacker could use that to get into her email. Disturbing, but what disturbed me more was his statement that “I can use your email to see what online forums you’re a member of”. First of all, I presume that’s only the forums where you make your email public? Are there programs or search engines that allow people to put in your email and discover what forums you’ve logged into with that email, even if the email is kept private? I’ve posted on a few forums here and there, and though I never wrote anything too horrible, I wouldn’t want a prospective employer or snoopy ex-girlfriend getting to see that. Any input’s much appreciated. ---
**Author:** ![Keeve](https://avatars.discourse-cdn.com/v4/letter/k/f07891/32.png) [@Keeve](https://boards.straightdope.com/u/Keeve)\ **Post date:** [July 24, 2013, 9:15pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/2 "2013-07-24T21:15:04Z")
Yes, I’ve seem many. Many others delete some letters, and/or change “@” to “AT”, but not all. Try Googling your own email address. You might be surprised! ---
**Author:** ![JerrySTL](https://avatars.discourse-cdn.com/v4/letter/j/e274bd/32.png) [@JerrySTL](https://boards.straightdope.com/u/JerrySTL)\ **Post date:** [July 24, 2013, 9:17pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/3 "2013-07-24T21:17:29Z")
Just do a google search of your email address and see what shows up. Just remember that Google is just one search engine and there are others places to search. ---
**Author:** ![Tanhauser\_Gate](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@Tanhauser\_Gate](https://boards.straightdope.com/u/Tanhauser_Gate)\ **Post date:** [July 24, 2013, 9:20pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/4 "2013-07-24T21:20:50Z")
I googled my emails, thankfully only minor things came up, like comments I’d made on some blog–though I could swear I didn’t offer up my email publicly… e.g. things like “[blahblah@gmail.com](mailto:blahblah@gmail.com) says:” and my comment ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [July 25, 2013, 1:42am UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/5 "2013-07-25T01:42:04Z")
On some websites, they could probably try to log in as [tanhauser\_gate@email.com](mailto:tanhauser_gate@email.com) and depending on the error they get back (invalid email or invalid password) know whether you’re registered there. And almost always, trying to register with an existing email account will result in an error saying such. So if they went to [Pervs-R-Us.com](http://Pervs-R-Us.com) and tried to sign up as you but your email was already in the system, that’s a likely sign that you’re already a member there. This is even more the case when the website requires an activation link in your email, because that’s de facto proof that somebody with access to your email account signed up (or they wouldn’t have gotten the activation email). ---
**Author:** ![stui\_magpie](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/stui_magpie/32/11010_2.png) [@stui\_magpie](https://boards.straightdope.com/u/stui_magpie)\ **Post date:** [July 25, 2013, 3:32am UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/6 "2013-07-25T03:32:55Z")
Interesting, I just googled 2 of my email addresses and got zero hits. Tried the same in Dogpile and same result. ---
**Author:** ![Tanhauser\_Gate](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@Tanhauser\_Gate](https://boards.straightdope.com/u/Tanhauser_Gate)\ **Post date:** [July 25, 2013, 1:40pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/7 "2013-07-25T13:40:35Z")
I knew I’d get busted for [pervs-r-us.com](http://pervs-r-us.com) eventually ---
**Author:** ![Northern\_Piper](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/northern_piper/32/5304_2.png) [@Northern\_Piper](https://boards.straightdope.com/u/Northern_Piper)\ **Post date:** [July 25, 2013, 2:01pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/8 "2013-07-25T14:01:20Z")
I had the same results as **stui magpie** - no hits on my personal e-mail account; some for my work account, but nothing surprising. ---
**Author:** ![Alba](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Alba](https://boards.straightdope.com/u/Alba)\ **Post date:** [July 25, 2013, 2:03pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/9 "2013-07-25T14:03:05Z")
> [@Tanhauser\_Gate](#): > > Apparently that’s how Scarlet Johanson’s pictures were leaked–she’d left a bunch of information online like the name of her pet, what high school she went to, etc, and a hacker could use that to get into her email. Leaving stuff on the internet such as favourite pet, your mother’s last name, etc. can be used to answer your “secret” question and so reset your password. Most sites this isn’t possible any more. But I believe you could swap the receiving email address where the new password link was sent to for your own. ---
**Author:** ![Blakeyrat](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@Blakeyrat](https://boards.straightdope.com/u/Blakeyrat)\ **Post date:** [July 25, 2013, 6:01pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/10 "2013-07-25T18:01:36Z")
> [@Reply](#): > > On some websites, they could probably try to log in as [tanhauser\_gate@email.com](mailto:tanhauser_gate@email.com) and depending on the error they get back (invalid email or invalid password) know whether you’re registered there. As a web developer, I want to ensure everybody that that is considered bad practice in the field. The error for a invalid username or password should always be vague enough so you can’t tell whether the username or password was in error. (Not just the message displayed to the user, but the message from the authentication server as well.) It’s rare you find a website that makes this mistake, but there are millions of websites. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [July 25, 2013, 6:30pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/11 "2013-07-25T18:30:50Z")
> [@Blakeyrat](#): > > As a web developer, I want to ensure everybody that that is considered bad practice in the field. > > The error for a invalid username or password should always be vague enough so you can’t tell whether the username or password was in error. (Not just the message displayed to the user, but the message from the authentication server as well.) > > It’s rare you find a website that makes this mistake, but there are millions of websites. Bad practice, sure, but quite common in my experience. Try logging in with “[test@test.com](mailto:test@test.com)” (which is usually taken) versus something random and unused, like “[asdfwaefw234w2r2@asdff.com](mailto:asdfwaefw234w2r2@asdff.com)”. The [SDMB](http://boards.straightdope.com/sdmb/login.php?do=lostpw) is guilty, for one. [Facebook does it](https://www.facebook.com/login/identify?ctx=recover) (and even tells you the name associated with the email account). Reddit does it if you try to register with an existing email. Slashdot does it. From Wikipedia’s [list of internet forums](http://en.wikipedia.org/wiki/List_of_Internet_forums), the top three ([Gaia](http://www.gaiaonline.com/account/sendpass), [Bodybuilding](http://my.bodybuilding.com/login.php), [XDA Devs](http://forum.xda-developers.com/login.php?do=lostpw)) all do it. Hell, even the [official vBulletin forum](http://www.vbulletin.com/forum/lostpw) does it, which likely means that any forum using their software has the same issue. (ETA: My contradictory opinion is that the internet is a very insecure place and vulnerabilities are discovered daily and fixed monthly if you’re lucky. Many web developers, me included, have a very poor grasp of security principles. And even the big boys routinely fuck up. Your information, once online, is never truly safe.) ---
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [July 25, 2013, 8:08pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/12 "2013-07-25T20:08:33Z")
> [@Blakeyrat](#): > > The error for a invalid username or password should always be vague enough so you can’t tell whether the username or password was in error. But what if someone tries to register as a new user with your email address? They would either succeed, or get an error message saying that email address is already registered (which tells them you are a registered user of that site). ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [July 26, 2013, 9:04am UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/13 "2013-07-26T09:04:06Z")
> [@Reply](#): > > Bad practice, sure, but quite common in my experience. Try logging in with “[test@test.com](mailto:test@test.com)” (which is usually taken) versus something random and unused, like “[asdfwaefw234w2r2@asdff.com](mailto:asdfwaefw234w2r2@asdff.com)”. The [SDMB](http://boards.straightdope.com/sdmb/login.php?do=lostpw) is guilty, for one. [Facebook does it](https://www.facebook.com/login/identify?ctx=recover) (and even tells you the name associated with the email account). Reddit does it if you try to register with an existing email. Slashdot does it. From Wikipedia’s [list of internet forums](http://en.wikipedia.org/wiki/List_of_Internet_forums), the top three ([Gaia](http://www.gaiaonline.com/account/sendpass), [Bodybuilding](http://my.bodybuilding.com/login.php), [XDA Devs](http://forum.xda-developers.com/login.php?do=lostpw)) all do it. Hell, even the [official vBulletin forum](http://www.vbulletin.com/forum/lostpw) does it, which likely means that any forum using their software has the same issue. > > (ETA: My contradictory opinion is that the internet is a very insecure place and vulnerabilities are discovered daily and fixed monthly if you’re lucky. Many web developers, me included, have a very poor grasp of security principles. And even the big boys routinely fuck up. Your information, once online, is never truly safe.) Wow, this is really interesting. Facebook DOES give different messages for wrong password and nonexistent accounts, but it only displayed account name and profile picture for my account, so I think it only does that if you’ve logged in on this computer recently. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [July 26, 2013, 9:19am UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/14 "2013-07-26T09:19:20Z")
> [@scr4](#): > > But what if someone tries to register as a new user with your email address? They would either succeed, or get an error message saying that email address is already registered (which tells them you are a registered user of that site). They could just say “Thanks for registering. The email you used was [blah@blah.com](mailto:blah@blah.com) Please check your inbox for an activation message. You will not be able to log in until you activate your account.” And then to the actual email address, assuming it was already registered: "Somebody tried to register an account with your email address at our website, but you already have an account! Click here to reset your password. If it WASN’T you, just ignore this email. You won’t get this message again for another month. You can also log in to your account to disable these notices for good." ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [July 26, 2013, 9:27am UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/15 "2013-07-26T09:27:47Z")
I googled mine and just get a handful of Firefox bugs I’ve reported. (Make sure you use quotes, or it may search for just your username.) Bugzilla seems to be the odd site out in actually displaying your email address. I’m sure that they could get more information from stuff that’s been hacked, though. And, yes, there’s almost always a way to see if you’ve used a particular email to register on a website. The vague error messages only stop the stupidest of scammers and cause a bit of inconvenience to legitimate users. A very few sites may warn you if someone tries to sign up with your email (ala Reply) but they’re so few I don’t even remember which one(s) it was. ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [July 26, 2013, 1:16pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/16 "2013-07-26T13:16:04Z")
Of course, if your password is your pet’s name (“Fido123”) or your spouse’s, or your kid’s, then you are begging to be hacked. ---
**Author:** ![Fubaya](https://avatars.discourse-cdn.com/v4/letter/f/c2a13f/32.png) [@Fubaya](https://boards.straightdope.com/u/Fubaya)\ **Post date:** [July 26, 2013, 3:29pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/17 "2013-07-26T15:29:22Z")
> [@Tanhauser\_Gate](#): > > Disturbing, but what disturbed me more was his statement that “I can use your email to see what online forums you’re a member of”. Did they mean they can do this after breaking into your email or just by knowing your email address? Just knowing the address would be hit and miss but if they break into it, you may have various emails from forums that they could see. ---
**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\ **Post date:** [July 26, 2013, 4:08pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/18 "2013-07-26T16:08:59Z")
If you have any sense, you create an account with gmail specifically to join pervs\_are\_us and then never use it again unless you have a problem with that specific site. As an aside. It is better to have complicated passwords and to write them down, than to have simple ones you can remember ---
**Author:** ![Tanhauser\_Gate](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@Tanhauser\_Gate](https://boards.straightdope.com/u/Tanhauser_Gate)\ **Post date:** [July 27, 2013, 5:27pm UTC](https://boards.straightdope.com/t/what-can-people-find-about-me-from-just-my-email-address/664416/19 "2013-07-27T17:27:28Z")
> [@Fubaya](#): > > Did they mean they can do this after breaking into your email or just by knowing your email address? Just knowing the address would be hit and miss but if they break into it, you may have various emails from forums that they could see. Ah, maybe that was it, I could have misinterpreted. That said I imagine it must be accessible somehow, so I’d definitely second what bob said above.