Hacker News Reader

Comment by slim | Hacker News Reader

I want a button that says "ghost this mailing list" when I click it, their mail server gets a standard message like "user no longer exists at this address", or "user reached quota", whatever makes me get pruned from their database instead of having my email address validated and the "last_seen" column updated.

View on HN

I've done something like this [0], postfix sends a nice rejection message the next time they try to connect. Ironically I've had people email me that rejecting their spam is filling up their inbox with error messages.

[0]https://blog.tinned-software.net/permanently-reject-a-specif...

>Ironically I've had people email me that rejecting their spam is filling up their inbox with error messages.

Wow

I get this on my domain, it’s called backscatter I think. https://en.m.wikipedia.org/wiki/Backscatter_(email)

Less technical folks would likely complain about it, as it tends to resemble the spam that was sent from their spoofed domain (I.e. “re: fake pills” subject lines as the rejection message hits their inbox).

In my case this isn't it. What happens is during the connection process the server on the other side first announces what email its sending from, at that point my server responds with a reject message and closes the connection. I don't think my server even sees the subject or body. My server doesn't send a email, but instead that email is generated by the sending server to let the user know the message was rejected.

This error message is often delivered to a catchall account, they are often configured with small mailboxes, that box fills up, throws alerts and ticks off a sysadmin somewhere. I only do this in cases where it's easier to SSH into my box and configure it than unsubscribe, and never to random address spam as that is wack-a-mole and futile.

I think the sending servers may also be misconfigured to get around greylisting. As sometimes they will try repeatedly to deliver to me. My server dutifully rejects each attempt and the messages pile up on the other side.

I like your approach and it looks like its usability can be greatly improved by having an admin panel to easily taint a given alias rather than ssh to the mailserver and modify sender_access manually.

are you certain your "mailbox full" automated message hasn't been met with a "your rejected messages are filling my inbox"... that also happens to be an automated message :)

This is pretty much what Apple did with Sign in with Apple. You can sign up with a private relay email and Apple will forward any communications from that company to your real personal email account. If you get annoying emails, you can simply dispose the private relay email and boom they can't communicate with you anymore.

For those interested, Mozilla is planning a similar service (though still invite-only at present): https://relay.firefox.com/

Can't wait for it to become available. I'd even pay a subscription to make it sustainable.

can you invite me ? email in profile ;)

Sorry, I don't have an invite yet either; I don't know how those get allocated. I'm just keeping an eye on it for it to become available.

And all for the low low cost of a MITM

Like any other hosted email client.

I am not sure I understand, can you please explain (or link me?)

If Apple can redirect the email to you, they can also store and read these emails.

By that logic so can google with gmail: of course they can, but that’s why we have to put some level of basic trust in our email providers. If you don’t want an MITM, you’re basically stuck with PGP or hosting your own email service.

Lavabit used to not be able to do that, and Protonmail can't either still... (To be fair, Lavabit _could have_ made changes so they could do that, but the owner refused when law enforcement asked him to do that fpr Snowden's email, and risked very real threats of jail instead. I don't think Protonmail have been tested lie that yet, but they have at least incorporated outside of US jurisdiction,which changes their risk in some important ways...)

https://en.wikipedia.org/wiki/Lavabit

If you use Apple SSO but your email is hosted elsewhere, Apple has introduced themselves as a MITM for your email. Facebook SSO doesn't do that.

you can use apple sso with the real e-mail too, as far as I remember. it’s an option.

Oh sure, it's just that it adds another "man in the middle", where previously there was only your own email provider.

You can kind of do this with Fastmail and Aliases, but it's a more manual process.

You can really easily create aliases for specific sites or just a general spam@ alias on your own domain. Then if it gets abused you can mark all mail directed to that alias to bounce.

You could later re-enable it if you wanted to.

I migrated from Gmail to Fastmail 2 years ago, and I agree with this. With Fastmail, I now have the wildcard address for a domain ([a-z0-9]{7}@example.com), whereby I create a new randomly generated email address for each company/site/contact. I set up rules to direct emails sent from expected addresses (sometimes by base domain regex rather than a single address) to whitelist emails to show up in my main Inbox folder. eg. My HackerNews email might be qvae82d@example.com, whitelisted to accept emails from *@ycombinator.com to my main Inbox.

The thing is you don't want to completely blackhole/delete messages received at a valid randomly-generated address, but which were sent by an unexpected sender. For that, I have a separate "Suspicious" child of my main "Inbox". The main exception I've seen that falls under "Suspicious" is that Amazon shares your account's email address with their shippers; so you'll receive a Fedex delivery notification at your Amazon address, which falls under "Suspicious" because the sender address doesn't originate from Amazon.

What I find mildly strange is that, in the 2 years since I've migrated from Gmail to a super-organized and rules-based organization with Fastmail, I have literally not received a single spam email. I credit this to having migrated my GitHub account to use their privacy wrapper, so none of my commits have a personal email attached to them. I thus suspect that most developers who receive spam have had their email crawled from commits to public Git repositories.

Of course, there is a caveat: I do not expect to be able to maintain this kind of scheme into old age. There's no way, at 60-70-80-90 years of age, that I will still be mentally capable of managing a wildcard domain. So while it works for now... at some point I will need to simplify back to a single email address. Sigh... fml in advance. :(

> There's no way, at 60-70-80-90 years of age, that I will still be mentally capable of managing a wildcard domain.

Do you think this will get technically harder and you'll no longer be familiar with the "new" process? Or are you more worried about your mental capabilities in general when you're that age?

Most of us will wind up with some form of mental or physical degradation… that may mean Alzheimer's, or Parkinson's, or psychiatric conditions, or horrific cancer (eg. prostate, breast, uterine, COPD/emphysema, etc.) that weakens us for months or years at end-of-life. The fact is, there are so many things that can go wrong regarding health in one's mid-to-late years, that expecting to manage a complex identity/password system is unrealistic.

That’s interesting - I haven’t seen GitHub’s privacy wrapper in their docs, do you have a link?

I’ve gotten some spam, but so far it’s only come in to aliases I haven’t made (like info@) which I think I can block in the fastmail settings.

I did this a while ago for myself; it looks like the setting can be found here[1], labelled as a checkbox "Keep my email addresses private". Note that (I think, not sure if it gets overridden if you check the box), you also need to set your "user.email" git config to use the noreply email they provide. Personally, I'd never committed to an external 3rd-party repository, and I crushed/re-imported (erasing history) my own repositories using the new noreply email. This is because I know no external users were depending on my old repositories. I suspect that if you've already pushed commits to a 3rd-party repo, it's too late (the email address is part of the commit and cannot be revoked without a history-changing rebase). In my case, I deleted my repos and re-imported, history be damned.

[1] https://help.github.com/en/github/setting-up-and-managing-yo...

Ah thanks - yeah I've already pushed with my new aliased email for git (I recently switched to Fastmail and set up a less extreme alias configuration :) ).

you can set things up much, much easier, fastmail calls it subdomain aliasing or something like that.

Basically, it allows you to create email aliases without having to whitelist.

Setup yourname@yourdomain.com and reject everything else arriving there.

Accept anything at @i.yourdomain.com

I have an inbox, everything yourname@yourdomain.com arrives there.

Then I have an "other" mailbox where all the @i.yourdomain.com emails arrive.

If there is a really annoying website that doesn't respect my wishes I create a filter for the offending email to ban any mail to my spam folder.

Could this be automated, e.g. by a browser extension or a small app setting up an alias and an ding a site-specific rule to your FM account? I am thinking about a one-click sort of thing, a DYI alternative to Sign In with Apple.

Ideally generating a disposable email address should happen at the same time you generate a unique password in your 1Password/LastPass/etc.

Correct, I was trying to assess if I should prototype a solution myself, hence the browser extension path.

It unfortunately would probably only do the opposite as this validation occurs during the SMTP transaction when the message is delivered to the server.

Going back after and saying you don't exist is like answering the phone and going "nobody is home".

Edit: I suppose this ghost setting could be used for future delivery attempts though. Perhaps this is what you meant originally.

I work for an email service provider. While we usually get a response from the inbox provider that an inbox does not exist, we totally get async bounces all the time. Some providers accept the mail and realize later that they cannot deliver it.

Can confirm. Async bounces make up somewhere around a few percent of overall bounces for most senders.

While true, email accounts can and are deleted or closed. Transient addresses on your own domain are usually the best (so you can nuke them when polluted, hat tip to Apple for pushing blind emails into the mainstream with "Sign in with Apple"), but sending fake bounce backs by sender while binning anything incoming from them is a close second (Gmail and Fastmail both support filtering messages directly to Trash, but no fake bounce back messages; could probably do it with an SMTP proxy, again if you use your own domain).

I think they're talking about sending an error at the SMTP level. Not sure if that will break stuff though.

What GP describes would work the next time they try to spam you, not for the current email you received.

correct. it's for future deliveries

For me, Step 1 is using their Unsubscribe option.

If I get another message from them, Step 2 is to setup a mail rule to put everything from their company into the Junk folder.

I have another step between 1 and 2: send a mail to the abuse contact of their AS. You can do it either manually, or with a tool like https://www.spamcop.net/ . Sometimes it works (but rarely).

I only do step 1 if I actually consented to subscribe to a list.

If the sender just added me to their list without consent? Straight to spam.

Too much work, tbh. It's my mailbox, not theirs.

Right. Unsolicited email is spam and marking it as such is proper way to deal with it.

With "suspicious" sources step 1 confirms the address to them, which allows them to see it.

Delaying step two requires book keeping.

Immediately blocking is low effort with effect.

In few cases, where senders seem to be "proper" companies I do a GDPR request. Sometimes they provide valuable information about address brokers etc.

I think unsubscribing is a good/polite first step. If that doesn’t work, then a more aggressive spam/ghosting method makes sense.

Translates nicely to interpersonal communication

I am often subscribed to lists I never personally consented to. That can happen for benign reasons such as someone mistaking my email address for theirs, or more nefarious reasons.

For that reason I have no need to be “nice” to entities who send me unsolicited email. I avoid clicking any link on email I didn’t request as - just like answering the phone confirms that a live person is home - clicking “unsubscribe” just means the email address is valid and has a human behind it.

We have to stop pretending like there are humans behind our communication. If I had to guess, 99% of my email volume is generated by a machine of some sort.

reminds me of a time someone with my very uncommon last name and same first initial had signed up for skipthedishes.com with my [first initial] [last name]@gmail.com and started ordering takeout from various places local to them, halfway across the country. the website doesn't send a validation email when creating an account. this went on for months, getting a food order confirmation email with no charges on my credit card. finally I got so annoyed that I reset the password, logged in and found their cell number. I sent a polite text message describing what happened, assured that the website obscured credit card details properly and that they should change the password from [generic password].

Did you ever find out why that person signed up with an email that didn't belong to them? Did they intend to use a real email and for some reason didn't? Or did they want to use a dummy email that they didn't own?

Not exactly what you mentioned, but if you host your own mail server you can use bogofilter-milter.pl[1] when it detects that mail is a spam it rejects it with a configurable message.

[1] https://stuff.mit.edu/~jik/software/bogofilter-milter/

It would be interesting to see the side effects of doing something like that.

Maybe @dhh could use this idea on hey

Reply on news.ycombinator.com