Hacker News Reader

Comment by kurthr | Hacker News Reader

It seems like most websites use your email address as the username, which makes this more difficult. You could use + addressing, which makes it unique, but doesn't really make it private... really need hidemyemail or something similar!

I do wish this was easy and automated.

View on HN

Check out Firefox Relay and the corresponding Firefox extension. You can pre-register some-random-string@mozmail.com, which will forward e-mail to your actual address. If you pay for it, you'll have your-own-subdomain.mozmail.com, which acts as a catch-all, and you can use without pre-registering any-address@your-own-subdomain.mozmail.com.

You can reply from all addresses described above. The FF extension makes pre-registration of random addresses a little easier by putting a button on e-mail form fields.

There isn't convenient integration with password managers, that I know of.

You could be de-anonymised. Particularly by correlating your sign-ups using your-own-subdomain.mozmail.com. Or if the service is hacked. There's some argument that makes this service harder to generate spam with, and therefore less likely to be blocked. That's yet to be seen, I suppose.

> There isn't convenient integration with password managers, that I know of.

Fastmail also offers this service, so I think it's becoming a popular enough idea that password managers may start to see value in introducing it. Hopefully...

Fastmail actually has 1password integration for their "masked" emails. https://www.fastmail.com/1password/

I have been very happy using fastmail as my email provider and 1password as my password manager. They have an integration which allows you to generate masked emails, which makes what you're describing possible.

This. It’s one of those sticky features that keeps me on 1P, but as soon as bitwarden matches it Im out.

Looks like we’re getting really close.

> I do wish this was easy and automated.

It is, on MacOS and iOS. HideMyEmail works for normals, and Sign-in w/ Apple defaults it on.

The tools I linked rely on usernames that are public. I think most sites that use email addresses as usernames don't make the email address public (think of the spam). Are there example sites I'm forgetting?

true, but most of those sites have a separate field for "display name". No one want's their email address to be tagged on each post. :)

You can still often check to see if someone has an account for a service by just .. trying to sign in or retrieve lost password. You often don't need to have the password or access to the email to tell from the response if there's already an account registered for that email address.

That's a valid argument if your threat model only involves other visitors who aren't given access to see email addresses, but it breaks down if you're hiding from the site administrators, an attacker who obtains admin access, and whomever the attacker makes the data available to.

Run your domain email and use product@your.domain

Bad: sebastianmiller+product1@email.host sebastianmiller+product2@email.host

Good?: product1@sebastianmiller.ismyrealname product2@sebastianmiller.ismyrealname

Maybe don't use your real name are your domain name?

If it's a privately used domain, then tools could be modified or built to monitor that (if this approach becomes popular or if an individual becomes targeted, possibly other reasons).

Approaches for randomly generated usernames are probably the best way to go. DDG's @duck.com email service (and similar) is pretty fantastic if you're forced to use an email.

Reply on news.ycombinator.com