Risks of exposing professional email accounts?

Question

I am building out a product that displays user profiles and their professional emails (either company emails like [email protected] or academic emails like @mit.edu). In order to see the user profile and their emails, you need to signup and contribute your own professional email.

Would this be a security problem? I see plenty of users host their own personal websites and display their professional email accounts. Also, since you need to be registered to see other emails, this would stop bots. What other problems are there?

Answer 1

The security problem would be that you become a database of contact info. You have described few controls and no need for users to provide their personal details and contact info.

Marketers would scrape your database as well as phishers.

People posting their own emails on their own sites is one thing, but it is under their control, and they could be specific to the site. Collecting all this data together from multiple people makes this database a prime target.

Answer 2

You don't have a product

All you have is a database of email addresses. That's an asset, not a product. A product needs to do something with those email addresses.

Who would want to get access to this database?

For every company with an online presence and every academic faculty, webpages exist with email addresses publicly available. Google also exists, and can find these companies and faculties. Your business model assumes that the first thing a regular user would do is not to simply Google the company/faculty they're looking for. No user will ever do this. Perhaps you might have managed to sell this in 1994 - but not in 2024.

Who else would buy this? Spammers, scammers, phishers, and anyone else wanting a list of verified email addresses to attack. No-one else. Literally no-one else. And then again, these lists already exist in the scammer community, so they wouldn't go to you.

Who would want to sign up with you?

No-one with any awareness at all of basic internet security. Perhaps you might be able to scam some newbies or students into it, but anyone with the slightest clue will avoid this.

Suppose I'm signed up and another user gets my details to spam me, what can anyone do about it?

Zero. Nada. Zip. You can't show who the user was who got those details. The person on the receiving end can't stop the emails. They can't even show that the reason they're getting spammed is from signing up to your database. That's just how email works - there's no authentication/identification of senders.

Ironically this means you're probably legally OK. Anyone signing up to you is formally saying "you can hand this email address to anyone, including every scam artist in the world, and I don't care".

Won't having to put in their own email address stop scammers signing up?

You've clearly not heard of disposable email addresses, so no. You could try blocking the domain - except disposable Outlook.com/Gmail.com addresses are almost as easy to get too, and you can't block all of those.

In short

You're entirely unaware of all things internet-related, email-related, spam-related, security-related, and even how company employees and faculty members use email. This isn't an insult - it's merely a factual statement of what you would have to (not) know in order to seriously propose this. You can learn all these things, for sure, at which point you'll probably laugh at how naive this idea was.

In the meantime, please don't waste any more of your time on it.

Answer 3

Basically, since the sign-up to your service on ones free will, it is rather a privacy related topic (assuming it's security wise at the state of the art and well maintained).

A leaked email alone is not a security risk, but I poses a risk for further exposure.

If I would, in a professional context stumble over your service and what you described it offers, I would probably not sign-up for it. The risk my email, professional or not, would leak and I get even more spam that I get now is for me, personally, to high to counter the possible benefits.

Answer 4

There is a reason most reputable sites and services provide mailing and/or messaging services for members to communicate. It is to mask the private data of the members and protect privacy and security; or in some cases it is to protect a source of income because they sell the contact info as marketing data.

Without more in depth knowledge of the goals of your platform, I would highly recommend NOT displaying private contact info. You should even discourage users from setting their display name to their real name, or their email, or phone number. Though you can only do so much and some customers may not be aware or savvy enough to avoid these mistakes.

Some platforms have an innate need to share personal contact information. e.g. contractor job boards would post these pieces of data, but the customers are providing the data and expecting to receive communications by doing so.

If your platform doesn't have this innate need to directly share contact data amongst your customers, then don't.

And as all others have pointed out, build out your data layer security to protect the personal information you are collecting.

Answer 5

You have not stated why you would display professional emails. If there is no reason to display the professional email (and given there are reasons for [some] users not to want their emails shown), you should at least provide the user with an option on whether to show it or not.

You mentioned in a comment you wanted to show that a proof that the user was affiliated with the company. Note that in order to do that, it would be enough to show the domain of the validated email, no need to show the full email of the user.

You will anyway have a hard time to validate that professional emails are indeed that. There is no list of all companies with the email address they use (even if we ignore small ones using emails such as @gmail.com or @outlook.com!). You simply cannot figure it out automatically.

Restricting to academic institutions, that would be slightly more doable since that is a finite (albeit large) list and you could maybe go one-by-one reviewing which domains they use. It would still be fragile, though. So perhaps you expect @mit.edu, but then there is @math.mit.edu or @alumni.mit.edu Someone signs up as @mit.us (is that legitimate or not?) What about the professor using @teachers.org ? And so on.

Also, while a single leaked email could be hard to link to having originated from your site, you can expect that someone would publish "1 million emails from JobHunter69.com!!.txt" sooner rather than later (even if it's just scrapped data with little value), which would make the origin easy to find when everybody on that list start receiving viagra spam (or phishing mails, etc).