Hacker News Reader

Comment by orangepanda | Hacker News Reader

> A few more suggestions:

> “Create a different email address for every service you use,” wrote Matt McHenry. “Then you can tell which one has shared your info, and create filters to silence them if necessary.”

Obligatory mention - for gmail you can suffix your email address with a service name by using +, e.g., johndoe+adobe@gmail.com will be delivered to johndoe@gmail.com. So if a service leaks your data or sells your email, you’ll know who to blame.

Although the article recommends not to use gmail, it’s a neat trick if you’re stuck with it.

"Forget password" becomes unusable though, since you’ll probably forget what suffix you used for each service.

View on HN

Oh companies have become smarter about it! Even the scammers I suspect! Many won’t accept + in the email address and I think now it’s well known enough that most scammers will run a regex to detect and remove the + sign.

Useful workaround is to have unique aliases on a domain name you control. Can’t get around that with a minute of work!

If you control your email, you can do slightly better with the ‘+’. Share addresses of the form ‘me+my-tag@’, strip on ‘-’ to deliver these to ‘me+my@’, and have ‘me@’ immediately block the sender.

If you control your own email, why not just have company@ ?

fastmail supports a variation of this: if my email is me@mydomain.com, then I can use service+me@mydomain.com, or better service@me.mydomain.com (or anything@me.mydomain.com). It seems like it'd be a little less obvious to scammers.

With fastmail you can just make a alias. My address is me@mydomain.com and in the settings you can make a alias where you can just use something like garbage@mydomain.com

https://i.imgur.com/UWoU4NA.png

Fastmail also lets you use wildcards and catchall addresses, giving you infinite email addresses whenever you need them, with no way to tell what “base address” they resolve to internally.

For example, my Twitter address might be twitter@mydomain.com, my Google address google@mydomain.com and so on. All of those go straight to my inbox unless I decide to set up individual filters for them.

The downside is that I can’t easily migrate to a service that doesn’t support this.

Shout-out to my new mail provider Migadu [0] whose model is “pay for the number of emails you send, not the number of mailboxes you have”. This opens up all sorts of interesting opportunities.

Not affiliated, just a happy customer.

[0]: https://www.migadu.com/en/index.html

I have been using this system for about a year, and it works great. I generally use the pattern yourdomain.com@accounts.mydomain.net. However, I have found from time to time that I never get account signup/confirmation emails to these addresses. It seems like they're being silently rejected. Does anyone know if there's some kind of email validation service that might be filtering these?

I guess I could use a hash of the domain (eg asdffdsa@accounts.mydomain.net) to make my strategy less visible, but that feels like I'm probably overthinking it.

I use <random>@mydomain.com. My password manager remembers which I used.

Yes, it’s a great feature! They also have many non-fastmail.com domains available on the basic plan.

Well, another problem is that if you reuse email addresses, then a social engineering attacker has an easy starting place across all services.

>since you’ll probably forget what suffix you used for each service

You can put that in a safe wallet. OneDrive provides that now

Or set up a mail server and add as many aliases as you with, one for each service.

Outlook.com supports this as well, and so does Fastmail.

"." works the same way.

Not the same way. The dot would be filtered out, but the part after the dot won't get removed, so john.smith@gmail.com is equivalent to johnsmith@gmail.com.

Ah, you're right of course. I was too quick to reply. Sorry.

Reply on news.ycombinator.com