Hacker News Reader

Comment by dreamcompiler | Hacker News Reader

I solve the spam problem by having my own domain with an infinite number of email addresses. Whenever I sign up for something I use $PERMUTE@mydomain.com, where PERMUTE is some easily-reversible permutation of the vendor's own name.

This has two benefits: I can easily route/filter incoming email from that vendor, and if I ever receive spam at that address I know which vendor sold my info.

View on HN

I've seen a lot of people doing this. Maybe we should have a public database of what company sold emails to who that everyone who did this can contribute to, with some kind of proof required.

That's a great idea. I do the same thing as the parent poster, and I've seen lots of email addresses compromised. If it's one that I care about, I will contact the company. (Last time it was Tektronix, before that it was Roku.) They usually deny that it could have been on their end, which is BS because nobody besides them ever had the email address (assuming I wasn't hacked locally). The most common scenario is the insider threat. Some low-paid IT person with access to their database sells the list for a few tens of dollars.

Obligatory mention: https://haveibeenpwned.com

So we need a haveibeensold.com or emailsellingsites.com (still available)

Difficulty there is that many vendors are victims of data breaches, so they perhaps don't deserve to be demonized quite as much as if they'd outright sold the data. Could be difficult to prove which side of Hanlon's Razor they fall on.

That would be fair, but frankly as a user that gets the spam - I don't care. The damage to me is pretty much the same.

It would be important to stress it out on the page that it may be due to security negligence/failure rather that just data sale.

As a matter of fact.. they lost or gave away your info. They should reimburse you for that.

I’m working on something I call “datapoint tax”

Make this hoarding of data a (tax) liability. A policy like this will solve most problems.

If a company has a data breach, they most likely still have a security problem. While they may actually be victims if any 3d party software is exploited, it still comes down to system misconfiguration inany cases. And that would still be their fault.

That should depend on whether they informed the affected customers that their data was leaked in a breach or (if they weren't yet aware of the breach) how they react to the news that they have been breached.

I don't really care all that much if they sold it or lost it: they had it and were not good stewards of my data. That's all that I want to know.

You could argue that without painful consequences for breaches, companies will not care about preventing them from happening.

That would be nice.

I did this for a while. I gave up because it just wasn't worth the effort. I would run into exceptions to my permutation rule maybe. Or I signed up for an account and forgot which email I used so couldn't reset the password. Things like that.

> This has two benefits: I can easily route/filter incoming email from that vendor, and if I ever receive spam at that address I know which vendor sold my info.

There's just nothing actionable to do with this information. OK, so I caught badcompany.com giving my email address to marketingfirm.com. But the damage is already done. Sure, I can send them a nasty email, but it'll just get ignored or whatever.

I just started generating random addresses and putting them in password manager. The actionable bit is permanently black-holing all incoming mail to that address if/when I no longer need the service, or the "spam" rate gets too high.

I use gmail, so I just use the "Report as spam" option. I'm assuming Google uses that information in some way when calculating spam scores. So if enough people do the same, those emails will just start getting sent to spam automatically for huge amounts of people, and therefore punishing those folks for doing it in the first place. That seems more effective to me.

And I just never really had that big of an issue with spam where I needed to black-hole a specific email address. So for me it just wasn't worth the effort.

Yesterday I used the report as spam feature on an email from Microsoft.

The footer had no unsubscribe option and the "manage communication preferences" requires a login/password combo that I couldn't be bothered to reset for my new geolocation.

I doubt this'll make a dent in Microsoft.com's spam score.

People using "report as spam" is what made gmail such a great spam filter. Is also the reason google has such high market share of public email addresses. It's also why people running their own mail servers are afraid of being blacklisted by google.

More than 3 years ago I moved from a single gmail address that had a ton of spam, to a Fastmail wildcard domain with a rule for each individual/company that emails me. I use a randomly generated, 7-character username created from a-z and 0-9 for each address, stored in my password manager. eg. The email address for my Reddit account might be rkd64id@example.com.

While I think this scheme is perfection in terms of privacy and security in knowing which company sells or breaches my email address... the fact is I haven't gotten a single unsolicited email in the entire 3+ years. Not a single message that hit a spam/junk filter, and not one email that wasn't expected based on whitelisted rules. The closest exception is Amazon who shares your email address with their shippers for delivery notifications; while I do receive 3rd party mail regarding legitimate Amazon deliveries, I've never received any spam to that Amazon address.

I have come to a conclusion as to why I have never received a single spam email since switching to this scheme. When I transitioned my GitHub account away from the old gmail address, I used the privacy option to not publish my REAL email address in Git logs pushed to GitHub. I deleted my old repos, and re-imported using the GitHub-wrapped email address. Thus I surmise that for those of us who are developers pushing code to public Git repositories, the vast majority of the spam you receive is because your email address can be very easily scraped from those Git logs.

I expect to migrate back to a single email address in the future, for a singular reason: as I get older I cannot imagine managing these email filters and password manager entries. Eventually I will need to simplify things.

I just search my email for the company name or the address I used.

The action one can take is that if the address is distributed and you start receiving unwanted mail, you can filter out messages to that address.

> Sure, I can send them a nasty email, but it'll just get ignored or whatever.

If you're in the EU, then send it to their DPO instead, and CC the national data protection authorities.

I don't think it's quite that simple. Ignoring the fact that I'm not in the EU, the company would also have to have some sort of presence in the EU for that to have any effect. And then which company do I send it to? The original one? Or the one they shared my address with and is now spamming me? Presumably the latter, since they are the one sending the spam. But if the initial company shared my email address with that company, they probably shared it with a lot of others, too. And what are the chances someone who has resorted to these sorts of tactics is going to care anyway?

> he company would also have to have some sort of presence in the EU

If you were in the EU, they wouldn't have to have presence in the EU to fall under GDPR.

> And then which company do I send it to?

Both! One shared your data with a third party without your explicit consent, for non-essential reasons, the other one is processing it without your explicit consent.

> And what are the chances someone who has resorted to these sorts of tactics is going to care anyway?

Depends. A lot of business do awful stuff for as long as nobody cares enough to start raising fuss about it.

Speaking of that, for extra effect, complain about it on Twitter and Facebook, linking relevant companies' public profiles/pages. In general, it seems a lot of companies (particularly non-tech ones) are extremely sensitive about social media posts.

> And what are the chances someone who has resorted to these sorts of tactics is going to care anyway?

https://www.enforcementtracker.com/

(And the rules here: https://gdpr.eu/fines/)

> There's just nothing actionable to do with this information.

Of course there is. When it happens I add an entry to my procmailrc that routes those emails directly to my spam folder, and I never see them again. And I never do business with that company again.

Maybe there is a way to publicly shame them, even if only a low fraction of users forwards bad actors to a collaborative list

I do this using a catchall account with Fastmail, but I don't even bother obfuscating the vendor name. Occasionally they don't let you use an email with their name in it, which which case I add 'isdumb' to their domain and then use it.

It happens occasionally that they get confused, but so far I haven't run into any issues.

I do agree in principal that it would be better to have some sort of hash that maps their domain to the e-mail in a way that is easy for me to know but hard for someone else to figure out. Ideally in a way that is still reasonably easy to pronounce over the phone.

What would be really slick is to have such functionality integrated into a password manager.

I do the same and in addition to reselling of personal information, it also shows when there was a data breach, as a whole bunch of spam starts pouring in the ones that are breached. Sometimes before an official announcement is made as the case was with Adobe.

I used to do this, and recall one particularly irate call from someone asking "why is my company name in your e-mail address!?!" They seemed to be concerned that I was impersonating them.

That's why I permute it, so it's not so blatantly obvious. OTOH most email signup handlers are robots nowadays and no real human ever pays much attention to them, so it hasn't really been a problem for me.

Also do this, with two variations:

1. Use a catch all alias (zero-effort)

2. Just use the domain or in some cases company name

3. Use a sub-domain

The sub-domain is essential for catch-all, otherwise you get a crazy amount of spam. I forward it all to a single Gmail address, have a rule to move it to a specific folder (based on "to" address), and otherwise let Gmail spam filtering do it's thing.

I've been doing this since early 2000's, and had very few issues with using domain/company. One or two that dis-allowed it, a couple confused humans.

> The sub-domain is essential for catch-all, otherwise you get a crazy amount of spam.

Seconding this. I get a larger portion of targeted spam (addresses that I gave out in the past) with a sub-domain catch-all. At a normal second-level domain catch-all, I get more random spam addressed to common addresses like accounts@, billing@, and sales@.

Yahoo mail has a feature under Mailboxes, called "Disposable email address" that allows you to pretty much do the same. You choose a "base" name, and then you can create upto 500 disposable addresses of the form basename-keyword@yahoo.com - you can choose the "keyword" based on the site you're signing up for, the basename stays constant. All mails to the disposable address get delivered to your normal mailbox, but you can go and delete a disposable address or filter it to spam. Also, both the basename and keyword remain untraceable to your actual address (unlike gmail's + format that has your base email id embedded in it).

I used to use this earlier, but then I couldn't find the setting easily on their mobile web interface and got tired of either switching to the desktop version or waiting to get to a desktop to complete a signup. Nowadays, I just report spam if there's no unsubscribe option.

I do this as well using a not so well know trick that exists on most major email providers including gmail and iCloud: myemail+permute@icloud.com. Those emails will arrive at myemail@icloud.com

That is unless the spammer was clever to do the following:

  providersWithSuffixSupport = ["icloud.com", "gmail.com", "googlemail.com", ...];
  if email.endsWithAnyOf(providersWithSuffixSupport) {
    email = email.trimBetweenFirstOccurrence("+", "@");
  }

I have a site with users, and while we have no interest in selling their addresses, it still strikes me as futile when people add "+mysite" to their address. It would take me 2 seconds in excel to zap all those appendages.

Not everybody uses the scheme for some futile security purpose, some sites are just a bit annoying with their outgoing addresses with their non-nefarious communication and the + scheme can be a nice way for rules.

I hadn't thought of that case. I've always had good luck simple simple rules like, "if @theirsite.com then move to folder".

This won't help you tracking down which service leaked your e-mail address, because the first thing spammers do is trimming the +suffix.

How did you do this?

I do the same, but just use the vendors name as is.

I do it too. I've found some vendors that will not allow their company name in the email address. For example, samsung@mydomain.com cannot be used to register with any Samsung-operated service.

I do it too. I had one phone me, deeply suspicious, and demanding to know how their 'domain' came to be in my email address!

I thought it was an interesting blend of technical literacy both to notice and be bothered by that!

My fav bypass was using a string reversal on the company name.

I've been using me+company@mymail.com ever since. It works mostly except for the real bad websites that disallow plus signs.

I got two mails telling me I cannot use the company name in my e-mail, they'd file for fraud if I would.

(got resolved by explaining how e-mail works, but still)

This is the easiest and most widely available solution imo. I use ProtonMail which allows for plus addressing. Gmail also offers this feature if I recall correctly.

Can you do this without running your own email server? If buying email service from a vendor, costs are usually per user (per address).

You can use aliases. You get 600 aliases with Fastmail for example.

But really you could just set up a 'catch all' and have everything routed to one inbox, then use filters to filter the emails to separate folders.

So emails to $PERMUTE1@domain.com could be filtered to a $PERMUTE1 folder, and so on.

Fastmail supports "subdomain addressing" out of the box. So if the email address is ... user@domain.com ... then you can use ... <anything>@user.domain.com ... without setting up any extra aliases, Fastmail will just handle it as if it's for user@domain.com.

And you can also reply from such addresses without extra configuration. On the desktop I use MailMate as my email client, which works great with dynamic aliases. The win is that you don't have to configure anything extra when signing up for some online service.

https://www.fastmail.com/help/receive/addressing.html

You can do this in Google Suite btw, as you can configure a forwarding rule. The problem with Google Suite, last time I tried, is that they no longer want to sign emails with DKIM for such dynamic aliases, so you can receive emails just fine, but sending emails from such addresses is a problem if you have SPF/DKIM domain rules.

That's good to know. I've only just switched 48 hours ago, so this is something I'll look at.

I had them handle my DNS for that domain so I'm assuming this won't require any extra setup.

This is what I do, for both Fastmail and replicated for my own email domain.

One Fastmail alias can be "(asterisk)@domain.tld", by the way, so you can send and receive emails to every address possible. When you send an email from the (asterisk) alias, you can type whatever you want in the from address box. I use their DNS as my primary DNS for all my domains so I can email to/from all of them easily like this.

(asterisk) means the character itself, I can't figure out how to type one on this site though.

Edit: this wasn't a feature 3 years ago, I only discovered this 4 months ago when I added a few domains to my account and they added the (asterisk) aliases for those automatically.

Yes. easyDNS offers this service. They call it a "catch all mailmap." You also need your "real" mail server ISP to be okay with getting unlimited addresses forwarded to them. Some ISPs don't like it because it makes SPF more difficult.

https://kb.easydns.com/knowledge/mailmaps/

If you have gmail (not sure what other providers support this), you can use + or . in your email address and add anything you want.

For example: myemail+twitter@example.com or myemail.youtube@example.com both go to myemail@example.com

The nonstandard dot behavior turned out to be a really bad idea. I've had numerous instances of people signing up for other services (e.g. Amazon) with my gmail address, adding various dot combinations. Whenever I have contacted Amazon (or others) to report a security issue--that I have access to someone else's account because "their" email address is routed to me, I just end up having a really unproductive conversation.

I think you’re mistaken about how the dot works with gmail.

Last I remember, dots aren’t a separator like plus is, they just don’t count as part of the name.

So Gmail treats my.email@ and m.y.e.m.a.i.l@ as aliases of myemail@

Some email marketers are catching on to this approach though and automatically strip anything between “+” and the domain.

You could do subdomain aliasing instead (with Fastmail, or with Google Suite if you try hard enough) and there's no way to detect and strip that, since it looks and feels like a normal address.

It can be detected, just takes a bit more work (look up the domain's nameservers, see if they point to fastmail, if so rewrite the email address)

myemail.youtube@gmail.com would go to myemailyoutube@gmail.com (or my.email.you.tube@gmail.com). Gmail's email normalization is like: sed -e s/[+].*//g -e s/[.]//g

Assuming the vendor doesn't claim that having + is invalid. I've seen that quite a lot.

Not exactly so, dot in address is just ignored by gmail, so “myemail.youtube“ is equivalent to “myemailyoutube“, not to “myemail“. Plus sign works as you described.

I do that with ProtonMail, however anybody with bad intentions can remove the suffix. But it helps tracing leaks and lazy spammers.

Tons of places don't accept that as a valid email though.

Does it work with a dot too? Is this a Google Suite thing?

It works with a dot too, so:

exampl.e@protonmail.com == example@protonmail.com == e.xample@protonmail.com

This is a good guide on how you can leverage this technique to identify which website you signed up for, and who sold your email to third parties.

https://www.reddit.com/r/ProtonMail/comments/7425v7/protonma...

I do it with the free email address that comes with my domain name. In this case I'm using gandi.net but I'm sure most domain name providers have a similar deal.

I do this with FastMail aliases, works great!

Ahh aliases. Still show up in the main account though. I guess they can be filtered as spam.

Fastmail also has a catch all / wildcard option which I am using. You don't need to create aliases for every email; instead any email to *@mydomain.com goes to my single email inbox. And similarly I can send from anything@mydomain.com.

I use a subdomain for it. Anything to that subdomain is marked as read and filed in the "spam-adjacent" folder. I'll look in there for transactional stuff and marketing bs never increments my unread counter. Only real people appear in my actual inbox and it's basically email nirvana.

The way I do it is I use a subdomain for any aliased email, e.g. vendor.com@account.mydomain.com and then I just have rules to move anything sent to account.mydomain.com to a separate folder, then it never shows up in the main mailbox unless I put it there myself. Works fine!

I do this on G Suite with a single license.

I do this with migadu.com, as it gives you unlimited domains and addresses. Happy customer.

I use fast mail with a custom domain.

Any specific vendors we should be aware of? :)

I do pretty much the same thing. Although I don't do a lot of email sign up stuff anyways.

What percentage of companies sell your info?

I will answer, since I have been following this strategy for almost 20 years.

In my experience, very, very few companies sell email addresses. Maybe 1% or fewer. The vast majority of spam tied to company-specific addresses is the result of data breaches. I get spam to my (old) linkedin, dropbox, equifax addresses - all starting after they were hacked.

I have to concur. The spam I'm getting only comes to aliases I published on some public-facing site. So I get a lot of spam for fb@, and hn_work@ (used in "Who wants to be hired?" posts), but surprisingly not hn@ (which is in my profile) or hello@ (used on my website). I don't think I got spam for any alias I used only to register an account with some vendor.

I do this too, and this is also my experience. In fact, at first I expected my ad-hoc email addresses to be the target of a good amount of spam, but I was surprised to find this almost never happens.

Reply on news.ycombinator.com