Show HN: Chrome extension to add random hash to email addresses | Hacker News Reader

Show HN: Chrome extension to add random hash to email addresses

chrome.google.com

2 pointssvde4 comments

Op here.

Mail Hash is a little Chrome Extension to add a random string to an email address as an attempt prevent reusability for automated attacks in case a service get's hacked. Targeted attacks at specific addresses should be more difficult aswell, since an attacker would need to guess the random string you used for other services.

You can use plus addressing for providers that support it, e.g. your.name@gmail.com --> your.name+ha7s6@gmail.com

Or use a custom domain with catch-all filter, e.g. example.com --> ZpGM5rrfZ6@example.com

Code lives on GitHub[0] and the extension can be downloaded at the Chrome Web Store[1].

I'm happy about any kind of feedback.

[0]: https://github.com/jsvde/Mail-Hash [1]: https://chrome.google.com/webstore/detail/mail-hash/njjpbfib...

Op really cool idea. One issue and two questions: Issue:if someone got a password list, they clean it up by removing anything between the + and the @ so it dosent add too much protection Question1:if I get an email from someone addressed to a hashed address, could I easily figure out who I gave that email to? Question2: will you be porting to Firefox?

Thanks for the feedback!

Regarding the issue I fully agree with the answer of luckylion.

Q1: Since it almost has to be used in combination with some sort of password manager, you could compare the hash with the service you signed up for. But that's a bit inconvenient. Since you receive a mail for each new signup, maybe set up a mail filter, that gathers all first mail to a hash in a dedicated folder. This way you can compare the sender with the first mail for specific hash when receiving new mails. This would have the benefit to have the data right inside your mail app of choice.

Q2: Just ported to firefox thanks to your suggestion: https://addons.mozilla.org/de/firefox/addon/mail-hash/

Not OP but removing the hash will not really help, even if you've used the same password on multiple sites, because the attacker would need to know which hash was used to sign up for other services.

Compromised myname+leaked@example.org:mypassword won't help getting into my account at somewebsite that is registered to myname+secure@example.org:mypassword.

And, I suppose, it forces you to use a password manager, because there's no way you're remembering the email, even if you're using the same password ;)

Reply on news.ycombinator.com