Hacker News Reader

Comment by el_benhameen | Hacker News Reader

Going forward, you can append "+whatever" to the username portion of your email address, e.g. You+spam@gmail.com, and gmail and most other providers I've used will ignore that part. Use it to trace the sharing of that address. I used that when signing up for a particular mailing list and found that my address was shared with about a dozen other marketers.

View on HN

People have learned that you can simply strip that part out of the address... it's in the standard. If you want to know where your data leaked out, you should use a different email every time (e.g. use your own domains).

> People have learned that you can simply strip that part out of the address... it's in the standard.

I'll take "Common RFC 821/2321/5321 myths" for $300, please.

RFC 5322 and RFC 5321 are very emphatic that the local part has no semantics whatsoever except those given to it by the MTA. There is no semantics for what "+" means in the standards.

Using Postmail's virtual aliases and a nice web interface to manage them, I create a random virtual alias (h9jle20gavs32@domain.tld) associated with a site name for every place I have to input an email address, it makes spam tracking pretty simple.

I would love to see a spam-shame site made by people who do this, outing the companies who sell or trade our email addresses.

Maybe + as a whitelist rather than a blacklist.

I'm still surprised that so few people know about www.spamgourmet.com it's been around for 15+ years and offers the exact feature you're talking about. You don't even have to create the alias, it will be created on first use.

The shady places will just trim everything after the + anyways

Yeah, I’ve always figured as much. I use Yahoo’s disposable emails that don’t feature a “+” in them. There’s no way the sender can tell they’re sending to an alias.

This comes up every time and that's just too much of a pain in the ass for basically no reward. Do you think spammers are too stupid to strip out the + part themselves? Its not worth the effect to even open the emails so having the + doesn't personally help me. I'd have to worry about having a different email address for every service I use? no thanks.

> Do you think spammers are too stupid to strip out the + part themselves?

No, but they are only targeting gullible people anyway so they don't bother:

> Finally, this approach suggests an answer to the question ["Why Do Nigerian Scammers Say They are From Nigeria"]? Far-fetched tales of West African riches strike most as comical. Our analysis suggests that is an advantage to the attacker, not a disadvantage. Since his attack has a low density of victims the Nigerian scammer has an over-riding need to reduce false positives. By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor.

https://www.microsoft.com/en-us/research/publication/why-do-...

This is also the reason for bad spelling/grammar/etc -- most of it's probably mostly intentional.

(Which is really depressing and shows just what awful people these spammers/scammers are.)

Reply on news.ycombinator.com