Hacker News Reader

Comment by asimpletune | Hacker News Reader

I have found Apple's "Hide my Email" feature to be really nice for this stuff. It allows you to generate an unlimited number of unique email addresses that relay email to your registered one, without exposing the actual address. It then integrates natively with forms, so I pretty much use a unique email address for each service. Then if I ever get spammed, I can just disable the relay and poof.

If you ask me this, should just be standard.

View on HN

I did this in postfix when I moved off Google after they removed free tier.

I also added a rule to make every sub-email into its own subdirectory so it is super easy to manage

Do you have any recommendations on how to get setup with postfix? I've been wanting to set up my own email service for a different reason.

as for Dovecot (IMAP) honestly their page has good instruction. It's very modular program but I just used basics. https://doc.dovecot.org/configuration_manual/quick_configura...

Postfix itself is, uh, well I knew it well coz we also use it at work, but it was a bit of work, as my setup was a bit specific. The config itself was simple (mostly off their docs again), but I did a bit of customization.

I did extremely simple auth with just a text file with list of all the accounts + a bunch of aliases. Auth was provided by dovecot

    ...
    passdb {
      driver = passwd-file
      args = /etc/dovecot/passwd
    }
    userdb {
      driver = static
      args = uid=vmail gid=vmail home=/home/vmail/%u
    }
    ...

    # auth for postfix submission
    service auth {
      unix_listener /var/spool/postfix/private/auth {
        group = postfix
        mode = 0660
        user = postfix
      }
    }

that just allowed to give smtpd auth this as extra parameters:

    +  -o smtpd_sasl_type=dovecot
    +  -o smtpd_sasl_path=private/auth

In the "other direction" (postfix sending mails to dovecot for delivery) I set up this in master.cf

    dovecot unix    -       n       n       -       -      pipe
      flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/dovecot-lda -f ${sender} -d ${user}@${nexthop} -m tag.${extension}

that is entirely standard except one thing, -m tag.${extension} is a bit of a "trick"; it will create any +address as a directory under tag/ (if you have "lda_mailbox_autocreate" set to "yes" in "protocol lda"

So, for example email to "me@domain.com" would land in INBOX but "me+badsite@example.com" would land in tag/badsite directory.

that just needs something like

    dovecot_destination_recipient_limit = 1
    virtual_mailbox_domains = example1.com, example2.com
    virtual_transport = dovecot
    virtual_alias_maps = hash:/etc/postfix/virtual

to set up

Amazing, thank you for your response

AnonAddy and SimpleLogin also offer this, it's very neat. Added bonus that, assuming each email is service_name@domain.com, you'll know exactly who has leaked your email if you start getting random spam.

Also Firefox Relay! https://relay.firefox.com/

(Which is a shameless plug, since I work on that, but I know there are quite a few people here who trust Mozilla and for whom it's relevant.)

And if you use it to generate email masks in your browser, it can remember what website you created on without exposing that to the sender, and without a trail linking the email address to your other addresses.

I had a business owner confront me over this (but the Gmail version where the format is name.service@gmail.com). Basically I was using a taxi service to get a one-time ride to the airport, they required an email address, so I did the usual name.tonystaxiservice@gmail.com (or whatever it was). The business owner contacted me over the telephone to 'confirm' my email address, seemed to understand what the purpose of the dot was because they expressed repeatedly that they're not a spammer, they won't sell my email, etc. and ultimately removed the dot from my email in their records because that's where I found an emailed receipt.

This was all before Apple's feature came to be. I just hope this kind of email 'protection' becomes more mainstream.

Yes, I often find it a bit awkward to give such addresses in person because I know they won't understand and may think it's a joke or whatever. There was one time I had to give an email address to book a PCR Covid test. When I got to the testing centre they were very confused by the address and insisted on sending me a test email that I could show to them to prove that I has access to the address. Thankfully I've not had anything as extreme as your situation though! Makes me wish this was easier to do with phone numbers...

Also, I just found out it is really nice that, when you order stuff from a bunch of sites, and you get a shipping update from a shipping company, without info about which of your orders it is about, you can immediately see that from the email address.

Dave used to do a custom version of this (I heard rumors that he stopped, I’m not sure). You’d put your email in a web form and his web server would create a temporary email address that would forward to his actual email for like 24hrs and then stop. You’d receive an email with the temporary address so you could send him whatever email you wanted to send him.

A pain, but he was serious about hating email spam.

I've got a cron job on my server that configures (current date)@(my domain) for one day. Works great!

I over-thought this and taught my spam filter about signed email addresses.

https://kevincox.ca/2022/07/07/signed-email-addresses/

Basically signed addresses are exempt from regular spam filtering. If they are abused they are blocked.

Yahoo mail offers a similar thing. It's a lot of effort to generate and track unique addresses whenever you sign up for something though.

Agreed, I think browsers should have a popup about the method you used to last sign in

Did you use Oauth that time? Which Oauth service?

Did you use an email? Were you on your phone and actually used the Apple Id “Oauth” looking button and gave a relay email?

Were you lazy and used your phone browser’s autofill and password manager?

Were you NOT lazy and an unhidden email and separate third party password manager?

Reply on news.ycombinator.com