Hacker News Reader

Comment by ggregoire | Hacker News Reader

> Like many of us I have an email address for Amazon (.co.uk) which I don't use anywhere else.

Out of the loop, what's the purpose of having a separate email address for Amazon?

The purpose is exactly this, to know that it must have been leaked via Amazon. And you can change to a different email address for Amazon (and redirect the previous one to your spam folder) without having to change your email addresses on any other accounts.

Do you have a separate email address for every service you create an account for?

Do you use email aliasing to achieve that? (e.g. your.address+amazon@gmail.com)

> Do you have a separate email address for every service you create an account for

yes, i run my own email server.

I have my own domain and operate my own email server with rule-based localparts filtering (basically regex-based whitelists and blacklists, plus automatic sorting into different mail folders based on localparts). I use a different localpart for each online shop and each service/social account/mailing list I’m registered with.

There are email providers that let you use your own domain (i.e. you don’t need to operate your own email server) with any number of localparts, i.e. a catch-all (without needing to use “+”), and which usually also allow you to set up filtering rules, and let you auto-forward to a different email address (e.g. GMail) if you like. You can then use whatever@yourdomain at your whim, without having to first register the localparts you use.

I've done this for years but... recently killed most of it.

Remembering when I've put a custom email (amazon@mydomain) vs a plus (me+amazon@mydomain) not to mention remebering both that I've used something fancy and, how exactly I customized it has just caused a bunch of headaches. I have warranty purchases across multiple email addresses for sites, figuring out what to type into the "forgot my password" box is a pain...

I even have a Steam login that I can't for the life of me recall how to get into. I only know the username, but I don't know how to request the reset email associated with it. None of my guesses have worked. So ... I just made another Steam account.

... and ironically the email address I give to close friends is the one that's all over haveibeenpwned.com.

/facepalm

My password manager usually remembers which address I use on which site, and otherwise I can quickly look it up in my email archive. For the most important accounts (ISP etc.) I write the credentials down separately. I always used consistent patterns for mapping domain/service names to localparts, so normally I can also guess right on the first try.

The issue I have is not remembering them, as the password manager does that. The issue is more when companies rely on your email address being the same for different parts of the service or they take my PayPal email address and use that as my email address.

One of the most annoying is when contacting customer support by email and they reject andy@ at and now I have to find a way to send an email to them from ocado@ or whatever email address I chose.

The PayPal problem can generally be prevented by registering an account first, i.e. don’t use guest checkout.

I use an email client that lets me specify an arbitrary From address, and also that automatically derives the From address either from the recipient of the message or from the To of the message being replied to, so it generally fills in the correct From address by default.

why not add AmazonSpam+your@email.com

I don't do it for every vendor but I have a separate email address that I use just for Amazon.

The primary reason is because Amazon has a huge security hole by way of chat and call center reps.

There used to be a way to hack into someone's Amazon account that went like this:

1. Call Amazon and say I'm 300 bps and my email is 300bps@gmail.com

2. Tell the rep you want to add a credit card on your account and give them the credit card

3. Do a forgot my password. One of the MFA questions was "What are the last 4 digits of any credit card on your account?"

So to hedge against this particular exploit and any unknown ones that come up caused by Amazon's giant target and their accommodative customer service, I just use a unique email address on their site.

I have a domain registered with Gandi, that does free email forwarding (free for up to something like 1000 aliases) I create a new one for every signup and forward them to my "real" email address.

You can also create a single "catch all" alias and be done with it :) (create an alias *@yourdomain)

I prefer to create them individually. If one starts getting spam, I'll delete that specific alias.

I use a different email address for every web shop I do business with, for the obvious anti-spam purposes. Amazon is just one of them.

I have done the same for years but I don’t think I actually had much benefit in the end. I don’t ever remember getting spam sent to dodgy-company@mydomain and then needing to block it, in all the 20 ish years I’ve done this.

the reason gmail gets so much spam relative to our individual domains is apparent if the mailer the spammer uses forgets to BCC everyone and you get a list of usernames in the CC: field.

They just iterate over every dictionary word and bolt on numbers and extra letters, or you'll see stuff like genewitci@gmail.com henewitch@gmail.com, etc. I haven't paid attention to gmail in a couple of years since i now use my own domain and fastmail (for $5 a year, even), so i have no idea if the mailing lists are more refined now or not.

Nearly everyone on earth knows about the dot separators and the +whatever that gmail allows, and will just trim that before they sell your email address, nullifying the usefulness. having someuniqueID@example.com is much nicer. you cut down on spam a lot, however it does open you up to a lot of spam to admin@ and webmaster@.

Reply on news.ycombinator.com