Hacker News Reader

Comment by wyldfire | Hacker News Reader

Maybe the real story is "DuckDuckGo Email Protection" [1]? I must've missed this one when it came out.

> Get a free, personal @duck.com email address. Emails sent to it will forward to your regular inbox, with creepy email trackers removed.

Totally genius! I fear there will be a cat-and-mouse-game but hopefully DDG will keep relatively up to date.

[1] https://www.spreadprivacy.com/introducing-email-protection-b...

View on HN

Fastmail has a "masked email" feature, which will forward emails sent to (potentially temporary) email addresses to your regular email account.

So will SpamGourmet[2].

Of course the problem with all these services is that you're giving yet another third party access to your communication and giving up your privacy to them.

They are all, as far as I know, completely unaccountable regarding what they do with the information they get from your private communication.

No matter what they say in their privacy policies, press releases, or PR, there's no way (as far as I know) to reliably verify any of their claims.

That said, I'd still rather deal with a company which at least claims to respect privacy rather than one that (like Facebook or Google) either spit on it or make money off tracking me and datamining everything they can about me.

[1] - https://www.fastmail.help/hc/en-us/articles/4406536368911

[2] - https://www.spamgourmet.com/

Fastmail handles my email anyway. So there's no extra risk in having them manage som extra email aliases.

There is the fact that, at least in Fastmail's case, you're paying for the service so someone would need to pay a LOT for the data for it to be worth it to the company to risk losing paid customers.

unfortunately this is also a signal of a juicier target for monetization, not that fastmail is doing shady things like that, but that's what less scrupulous companies see

The biggest missing feature on Masked Email by Fastmail is they don't remove trackers, as far as I know.

Masked Email gives you more privacy (the identity behind the receiver is unknown) and with data breaches, there's is no login data leaked.

Duck's Email Protection does also remove trackers from the forwarded mails. So senders can't trace back whether you have opened the mail. I hope they also remove click trackers, but I am unsure how they would implement that technology with the referral codes in the URL.

Fastmail proxies all images (when using their webmail interface), and AFAIK remove tracking images. https://fastmail.blog/privacy-security/fastmail-keeps-you-sa...

Reads are still tracked by virtue of the fact that the image was requested. Proxies do obscure the requester's IP address, but not much else.

they also typically obscure when it was read. Google at least pulls the image right away iiuc. If not then it really should.

most they should know is it was delivered. which is significantly better than nothing.

In Fastmail you can choose to only display images for emails that are in your contacts. Proxy is just another layer of protection for when you actually want to see the images.

As long as you use it for potentially spammy website account, you can minimize your footprint. Don’t use it to mail friends or co workers for example. Use multiple services so no one service knows the whole picture.

I have been using SimpleLogin for some time with my own domain and they have an open source backend so I am planning to host it myself so I can even use it for personal emails.

SimpleLogin looks pretty good as well.

Data mining was in the original Gmail TOS.

It was easy to miss - got posted to HN several times a few months ago, but never got much traction:

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Never got an invite, lost interest. Apple's product seems just as good to me.

I think they kept it free, had an invite system that gave invite no one ever. Tried twice then out of mind, out of sight.

Basically it seems like a gimmick or app-download-bait.

Wait - why would you need an app for this ?

This interface is a half page web form, right ?

Right ?

Right. I use two other e-mail forwarding services, and neither one requires an app or a browser extension - they're controlled through simple web interfaces.

While I'm a happy user of DDG's search engine, their e-mail service is not something I'd use.

I received my invite a while back. Maybe 2 months ago?

I didn’t get.

Kept the app installed for about two months. Was still waiting for beta access when I uninstalled it.

I never used the app as browser or anything. Neither gave it notification permission. Maybe that was the reason.

I signed up on a waiting list, I don't use the app.

I am not aware of any waiting list for this service other than installing the DDG app and signing up for the waiting list via app settings. I had searched around. It seemed that was the only way. At least by DDG officially.

There's plenty of such solutions, both selfhosted and otherwise. of course as soon as your domain is listed on disposable email lists, you'll be denylisted from many sites but fortunately enough usually the sites who care about who you are are the least interesting ones, and it's still possible to register in many places using disposable inboxes

EDIT: I should also mention most disposable email domains get added to the denylist after much use/abuse. By multiplying the domains/IPs serving disposable mailboxes, we greatly reduce the chance of being listed at all.

I set up my own domain and run my own personal disposable forwarding.

So I guess I’m making things slightly better for everyone :)

This sounds a lot like ‚hide my email‘ by Apple. I’m still concerned what is happening with my data.

With apple, I believe the illusion that it’s not necessary for them to sell my data.

Do we have similar insights about duck, besides our believe they won’t sell our data?

That's a fair concern. I just went to sign up now (apparently my invite was ready but the app hadn't notified me yet), and there's a section that promises their privacy protections will not be weakened by an acquisition:

> We will not allow an ownership change to weaken these privacy guarantees. DuckDuckGo (officially Duck Duck Go, Inc.) is a privately held, independent company, and has been since its founding in 2008. If we are ever acquired by another organization, or if another organization purchases this service, we will email you with details. However, we will not proceed with any deal that weakens these Privacy Guarantees.

As a (former) lawyer, I'd say that this provision is something I've considered necessary for a business to make a credible promise not to sell out at a later date. I have never seen such a provision before, and it makes me feel more confident that they've thought this stuff through and are willing to be held to their promises.

Well, once they get acquired with the promise that _privacy guarantees are not weakened_, what stops the acquirer from weakening them a year later? Just like Facebook and Oculus.

DDG would have to put teeth in their acquisition agreement such that doing so would result in an enormous surcharge or some such thing. They could also make a huge stink publicly, which would result in a mass exodus from their service, making such a move less lucrative for the acquirer.

But yeah, there's always a chance that these protections will go away. That's why it's important that they don't keep data right now, so if anything changes later you can just stop using the service (assuming you check HN daily so you'd know if anything was up!).

Is it possible to craft T&C that has a strong legally binding guarantee that future acquirers have to comply with, such as keep specific features or provisions? Something that would even stand in case of bankrupcy?

I don't think anything can be drafted that would be sure to survive bankruptcy. That's why it's important that they don't keep information in the meantime. If things go sideways, then you just stop using the service. They've committed to telling users if they're being acquired or whatnot.

Imagine if your housecleaner went bankrupt and had the right to sell your house or cover their debts. It's insane that bankruptcy legalizes theft.

They could setup a nonprofit ngo which had their user data keeping as it’s sole purpose, and privacy enshrined in it’s charter.

The nonprofit would be financed by ddg or whoever buys ddg, but the management of nonprofit would be forbidden from sharing the data regardless of how much anyone pays.

At least I think so.

I mean -- in a similar way to Apple, it's how they want you to see their brand. So no guarantees but it would be shortsighted of them to sell the info somehow. Definitely possible but I'm optimistic that they wouldn't.

You should probably consider self hosting your disposable email service. Sending email from home is tricky (at least to gmail/microsoft) but receiving usually works perfectly.

Ah, I was hesitant to even picture spinning my own thing up because of the commonly discussed hurdles. If there's a significant difference in ease between receiving and sending, I could live with that. Sounds super fun actually.

According to some friends, receiving email even works fine on dynamic IPs updated via some kind of DYNDNS-like service. I should probably do that, too! :)

That's a great point! Maybe replying works past the filters, too!

Nope consumer ISPs typically block sending stuff on port 25 whatsoever, and even if you get past your ISP Gmail/Outlook will block you even if your setup is perfect (reverse DNS, DKIM, etc): that's due to monopolistic behavior that's completely disconnected from reasonable expectations of spam protection.

Step 1) Download DuckDuckGo for iOS or Android

err no.

I love DDG and have run web search through them since they started, there are great

But I already have mail clients I use and they are not for for hand held computers owned by by G or A.

Basically the invite to a fresh trendy email address (I'm trying to get a short username over here!) is bait to download the app, the app is not necessary to use the service

I just downloaded it and think I'll enjoy it if it doesn't have the browsing quirks of firefox, it has a great "inferno" animation when you hit the button to close all tabs and delete history. Works with my password manager, promises to block trackers, meh, why not?

DuckDuckGo for iOS or Android is not an email client, but a web browser. The "join the waitlist for a free protected email" thingy is just an item in the settings.

Shameless plug for my project: https://www.mailbox.my also offers email addresses that forward to your existing email. You can send emails from that address as well, not just replies. We have 150+ domains to choose from. Some nifty features coming up, too!

Let me know if there's anything you are missing from your existing email service, always looking for ways to improve!

> we are not willing to participate in any dispute resolution procedure before a consumer arbitration board since it binds too many resources, but we are happily willing to refund your payment in case you are not satisfied with our services.

If someone's mail is compromised, or they lose their primary email address, a refund would hardly make up for it. This basically reads as "you'll have to force us to participate by taking legal action"..

The dispute resolution would not cover any damages incurred, so it would be a refund anyway. That is my understanding.

Would you expect language that offers compensation for any damages incurred, for example due to a hack or the loss of an email? I do not believe any email provider has such provisions. Of course we are still liable for any misconduct as specified by law.

> we are still liable for any misconduct as specified by law

Would this not be a process of consumer arbitration?

For example, If I believe there is misconduct, a GDPR or privacy violation say, is the process not to open a dispute with the EU, and then maybe go to an arb? I'm not aware that other email providers say upfront that they wouldn't participate in such a process.

There are many companies who do not participate in this process. I did not want to spend lots of time setting this up and adding another middlemen when the alternative is much simpler (contact us and get a refund). I still do not believe this platform is meant to claim damages, that needs to be done in court.

But I will have another look and probably support it when I find some time.

Edit: It's fixed now, we support the process. But please just send en email to us it's much easier ;)

I've been on the private beta waitlist mentioned on that page since this was announced, but not heard back yet, unfortunately.

Which mail-client shows images or runs JavaScript by default?

gmail, livemail, yahoomail. I.e. the clients that the vast majority of people use.

Edit: Though I may be mistaken: I haven't tested them in years.

Apparently google stopped blocking them in 2013.

Surely a more productive way to solve this is to not use such a terrible service? Rather than having to resort to a third party to strip it for you...

Gmail runs JS but only in AMP4EMAIL things

Reply on news.ycombinator.com