Hacker News Reader

Comment by anonbanker | Hacker News Reader

Note to self: use a new email account when using this service.

I try to do this for every service I give an email address to.

gmail still drops the ball, because you have to give your realaddress+marker rather than being able to request a marker.

The correct behavior is to be able to request a marker when signed into any email account, and on my side set the tag that it gets tagged with in that inbox as a result. The link between marker and inbox should remain secret.

I pay for a FastMail account which gives me up to 500 aliases. These are then sucked down in to my Gmail account.

I can't see a better example of Google dropping the ball than you paying for some other service so that you can then consume it from gmail. :)

500 is a reasonable limit I think, in case spamming would be some reason for them not to do this. I don't have an opinion about whether people should be able to send from marker@gmail.com or if it should just end up in a real inbox but without the ability to send from that address.

Out of curiosity, why do you do this? FastMail has an amazing webmail interface and Android app. I'd never go back to Gmail.

The original thinking was to make it harder for casual snoopers. If FastMail gets compromised, then they'd need to be compromised over time and someone would need to review a lot of my email with a shelf-life of one-hour to understand who I was - I use auto-generated credentials, paid via Bitcoin, and login once a year via VPN to generate more addresses.

If Gmail gets compromised, you'd need to be looking for a bunch of Fastmail accounts in To: addresses to link my primary email with those emails.

If you wanted to track me down from an email address, you'd need a warrant in Australia (for FastMail), and the US (to find the account using those FastMail credentials), so I'd need to have actually done something wrong (which I haven't), and you'd need to convince judges in two jurisdictions of that. As I said, the threat model is against casual snoopers, rather than a determined state actor with proof of wrong-doing, as I don't think I'm even slightly interesting and I don't think I've done anything that would make me interesting.

As it turns out, you could probably just read enough of my FastMail email as it came in (before it gets deleted by Gmail) to figure out who I am, so this is imperfect.

It'd be a lot simpler to rent a VPS and setup your own mail server.

You don't even have to specify an email address at all; it's considered optional in ACME.[0]

[0] https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-...

Reply on news.ycombinator.com