Hacker News Reader

Comment by whitehouse3 | Hacker News Reader

I do this with fastmail already. I have a domain that accepts email to *@domain.tld —- all the messages reach one inbox. All my online accounts have the form service-name@domain.tld

Makes it easy when I receive spam to see who sold my email address.

There’s also zero overhead to “create” a new one. It works for any address.

View on HN

I did this with even less setup. accountname+extratext@gmail.com has worked forever and you can do the same with a custom domain. I gave up fairly quickly because unless you keep meticulous records, there's no way to figure out the exact email you used very easily and I didn't get that much out of doing it.

I actually don't accept *@domain.tld even though I have a custom domain because I got too many fishing emails that weren't caught in spam. I didn't have the patience to deal with it. That might have changed over the decade+, though.

> unless you keep meticulous records, there's no way to figure out the exact email you used very easily

I haven't found this to be a problem. Usually it's in my password manager. Otherwise they've sent me an email, which I can quickly search my inbox for.

> I gave up fairly quickly because unless you keep meticulous records, there's no way to figure out the exact email you used very easily and I didn't get that much out of doing it.

Does one need to keep records? I just do service@domain.tld, for example: ycombinator@example.net.

I started receiving a lot of sexually-explicit spam addressed to recruiting@mydomain.tld, so now I know that one of the recruiters to which I gave this email address had their inbox/contact-list compromised.

Where I got bit was email was used as login. I was trying to log in but couldn't remember the specific email I had used even though I generally had a fairly specific schema.

A lot of services already worked out the + trick. Not many know about this feature of gmail yet: You can also put a dot anywhere inside your username. eg.

a.ccountname@gmail.com is the same as

ac.countname@gmail.com

acco.untname@gmail.com

and so on.

Be aware that using the “+” is giving you the illusion of privacy and control. A privacy research has shown, back in 2020, that companies like Oracle’s Bluekai (a massive ‘data broker’) has functions to normalize email with + in them to help with ad targeting and matching.

Other vendors and companies like FB are surely doing this too, as companies send FB emails for matching / ad targeting.

https://twitter.com/WolfieChristl/status/1288428611100454912

I guess it's good to know, but I never had any illusions of using it for privacy. It was mostly to see when I get added to a mailing list, where it might have come from. Another reason I abandoned it so quickly is, if someone sold my email address and put me on a new list, what can I do about it?

The trouble with *@domain.tld is that you get that many times as much spam. Unless your spam filter is 100% accurate, that increases the amount of spam that gets through.

I almost never get spam (see reply above), and if I do, then those addresses can be filtered easily. That is one of the purposes of using this setup.

I work through this by only accepting wildcards on a subdomain. I have a 'real' email address on the parent domain for actual human correspondence. Services and salespeople get the subdomain.

I am using name@random_site.mydomain because i encountered a few sites that rejected name+random_site@mydomain. reduces the "random name @ domain" spam, but still works good.

I do this too, have for 15 years. It works really well. I run a well configured postfix mail server for inbound and outbound mail. Incoming mail gets delivered to my fastmail acct. I get very little SPAM, a few messages per week, but I have spent a lot of time over the years getting it that way.

You don’t even need a wildcard email address to do it really, using a + delimiter in the user part of the address will accomplish the same.

For example: jdoe+netflix@example.org would be the address used on a netflix account.

However I do appreciate the additional anonymity a randomized or hashed user part provides

I do this too. My only issue I am having right now is I am "locked" to my current registrar because of how it is set up. Do you have a mail server you are using or just having your registrar do it? I am looking for alternate solutions that dont cost much.

Exact same for me. So far the only addresses (in probably around 200) that have been sold/leaked/spammed have been the one on my public site and Facebook, where it was public for a time.

If your facebook@domain.tld leaked, someone can guess you use mybank@domain.tld too and send something there.

And yet they haven't. If it becomes a problem, I could switch domains with a little work.

I do exactly the same, what is the advantage of masked emails over this pattern?

At least for me, the main advantage is that I can instantly block or delete a "masked" email address. With a catch all, you'll still be receiving mails.

Reply on news.ycombinator.com