Hacker News Reader

Comment by hansword | Hacker News Reader

The email address I give out to companies is theircompanyname@myserver.com - this has most of the privacy benefits the author describes. But frankly, I did it just to find out who sells my personal info to spammers. Turns out quite a few do, and whenever I get a spam email, i just look at the to-address and I know who betrayed me.

Edit: multiple typos

View on HN

I do the same. In addition to the security and privacy benefits, the traceability have been helpful. Years ago my Netflix account was hacked, and they refused to believe it was on their end. They were sure someone had accessed my email. I was not able to convince them that netflix@myserver.com was not a thing you could log into. But having a unique email was one of the clues that led me to be confident that my email had not been hacked, and it must have been something purely on the netflix side.

Playing devil's advocate - it could've been your Netflix password that was compromised, or someone you shared your Netflix password with (if you do it).

I used to keep it that simple but some companies are catching on and blocking the account in the name of "fraud" but really they are just upset. Instead I use a realistic looking canary that maps to their company without their company name being in the email address.

Companies that do not respect RFC email addresses are simply breaking the internet. Email addresses are not unilaterally specified by your marketing department, they are at this point, internet infrastructure.

https://datatracker.ietf.org/doc/html/rfc5322

Agreed but I don't think they care about RFC's. Rather they want to be able to track people and be able to sell or leak, but really sell your email address and email canaries put a stop to that behavior and they don't like it.

I spell their name backwards to thwart this filtering.

Oh, you mean VMWare... one of their CSR's they did that to me.

You can just spell it vwmare.

I too do it, although occasionally an hickup occurs. Last week, I signed up for something, and their system was unable to send an account activation email at theirCompanyName@myDomain.com I spent about 30 minutes with customer service on chat, and they were like, no, it's impossible to have them@my domain email. If I have, I should send them an email. I did it, sent email, and they were still not believing it.

This is what I do as well, and its real nice to be able to black hole a specific to email address vs trying to unsubscribe from every piece of spam email sent to your one email address.

I'm not sure I've ever found any indication of someone selling my address, but I've discovered multiple services that have been hacked.

One of them, Avvo, has yet to admit it... but it's quite clear.

Tesla did it to me, because I have had the same approach as grandparent forever (well, for 30 or so years, anyway).

Recently I had a text message to my phone number asking me if I wanted life insurance, and whether I preferred to be contacted at ‘tesla@<myserver.net>‘ or continue our conversation via text. I have plenty of life-insurance through my company…

Funnily enough, Elon didn’t reply to my tweet asking him if this was standard Tesla policy… Never did like that rat-bastard.

We should do something with phone numbers too.

It's not much better than "Your.Full.Name+company@example.com" in practice tho.

I'd say its one level beyond. Since "+" is so widely used, as talked about in the article, its trivial to remove. However with a non-standard domain and inconsistent username its not as easy to remove. These are some of the formats I use, they all offer exactly what I need (uniqueness, hard to programmatically attach to another, and culpability):

lyft@account.example.com

liftcarshare@example.com

email@lyft.com.example.com

example.com@com.lyft.example.com

I would personally go one level further.

Generate random email addresses so you can't easily guess what others I might have given out. Then keep track of the mapping.

A service like simplelogin.io makes this easy.

FastMail does something like this. Their Masked Emails are two random words plus a four digit number.

Been using this feature since they introduced it and can say that I'm very pleased with it so far in combination with it's 1password integration.

When creating an account somewhere, fastmail automatically generates a new email for the site via an API in one click.

Highly recommend.

icloud and also fastmail do this for you

What about base58 encoding their company name.

Caesar cypher.

What I usually do is servicename + 6 to 10 random numbers. This way I can see the intended recipient whilst avoiding people being able to check where I've signed up.

Why not use the numbers to encode the creation date?

You certainly could, though I don't particularly care about the creation date - additionally, this is something that I can do easily by hand.

E: Ah, I didn't see the schema one of the parent commenters suggested - your question makes a lot more sense now. I still don't really care about the creation date, though, but I do care about the email having a random component, since if someone were to figure out my naming schema, they could check whether I've signed up for any given service.

Great idea with the subdomain! May I ask how you do it? Also, one idea for you: how about using created20220621@company.example.com?

Fastmail allows for wildcat (J)IMAP addresses. It a *.example.com MAIL record in dns with a supported (J)IMAP server.

Lots of company don't allow you to enter the + symbol in their signup field.

I do this too, and lots of companies also don't allow you to use THEIR company name in the email address that you give them.

Sometimes their front-end is not aware of this restriction and will let you register, but then you'll have unresolvable issues. I've spent some time on tech support phone calls with companies that have this issue.

Occasionally a company will implement blocking their own name in a user-provided email after the user is already registered. I've had this happen a few times too. Suddenly the account will disappear without explanation.

A spammer can just filter the +company bit out.

Yes, but the fraction of users using the +company part would be similar to the fraction of linux desktop users on the internet.

The way we don't see most software companies supporting linux desktop users simply because it is not profitable, we can hypothesize that the spammers won't spend time-energy-money on getting the +company filtered out.

This is common enough that many sign-up forms reject the +. Spammers can definitely do that much.

Removing the +company is not cool. When I give you myname+yourcompany@mydomain.something, I'm authorizing you to mail to that address, not myname@mydomain.something. If you don't respect the recipient, you'll be rewarded with unsubscribes, at best, and spam reports at worst.

But we're talking about the same companies who will sell your data for a fraction of a cent. I don't think they care about being "not cool"

IME some may accept the plus address at sign up then break it at sign in or substitute for another character. A major US insurance company did this, which could have allowed hijacking if one had registered the address with the plus replaced with their substitute character.

Same here. It's fun getting doctors offices coming back and asking me "Do we have your email right?"

What tools do you use to create so many email addresses/aliases on the fly, and to keep a check on them?

Account creation doesn't happen on the fly, does it?

Here's my strategy with fastmail. I think it's the best:

1. I allow wildcards only on a subdomain. The friendly alias on the top level domain is only for real human beings I want to talk to, not robots or marketers. I don't allow cold messages to the subdomain into my inbox because of issues I've had with spammers in the past.

2. I use a random username as the address and store it in bitwarden. It isn't named after the company but I can match it there if I ever need to. Recently BW added a generator for this, but I was already doing it manually by freehanding on the keyboard.

3. Seive rules. I put newsletters in a reading list folder, receipts in a receipt folder, etc. Everything else sent to that subdomain gets sent to a purgatory folder that deletes anything older than 90 days, so I don't accumulate a bunch of garbage. If I am signing up for a newsletter that I don't care about enough to tune the rule, then I probably wasn't going to read it anyways.

As a result I have not had a low value message reach a high value folder in probably 5 years. Skimming the folder I can see that Illinois politicians are still trading my address around even though I moved out of the state 4 years ago.

I do the same but I have never ever caught anybody selling my email to spam companies.

Same. Did this for years and never found anything. Ended up going back to a single email address.

Reply on news.ycombinator.com