Hacker News Reader

Comment by dale_glass | Hacker News Reader

> As part of the UID2 API they specifically describe how an advertiser must "normalise" their users' email addresses. > > This means h.a.n.solo+iab@gmail.com becomes plain old hansolo@gmail.com

It seemed to be completely obvious to me even decades back, that the + scheme would be trivially parsed and reversed.

So I don't use it and just keep on making completely new aliases. So amazon gets amazon@example.com. If I'm not going to pay for anything on this account it also gets a random name from a random piece of well known media, like "Donald Duck", and all the data filled in randomly to ensure that it's not googleable, and doesn't correlate with any accounts anywhere else.

The bigger issue I see is the desire to link everything to a phone number. Even stuff made for privacy, like Signal.

View on HN

Even if I need to use my real address, I’ll use the “address 2” field to say something like “Amazon sold my information”

I’ve had quite a lot of third party junk mail with this kind of stuff on it over the years.

I like this! I will do this in the future.

That, my friend, is a brilliant trick. Genius award of the day.

That’s kind of funny and clever at the same time. Well done. I’m going to try this.

You can also use 26 different middle initials.

Why am learning this only now! Brilliant, thanks for sharing.

>The bigger issue I see is the desire to link everything to a phone number.

Yep, I've had my youtube account since before Google bought youtube in 2006. Just this week I noticed that I am no longer able to put URLs in the descriptions of videos I upload to youtube. I have to "verify" by giving them my phone number before any clickable URLs are allowed in descriptions. But apparently all URLs are clickable URLs. Additionally, even videos I uploaded in 2008, if I go to edit their descriptions now and I originally included a URL, I cannot submit it.

Phone number "verification" is nasty. I suppose this is the end of my almost 2 decades of using youtube to host videos.

As for email spam prevention, I've run my own mailserver with a domain since 2011. I give each service an actual unique email address and then just catch-all emails sent to my domain. It works great.

I think youtube's hegemony is past; it WAS the main point to upload your videos at some point because storage and bandwidth was expensive, and on-demand video conversion difficult and resource-intensive. But nowadays anyone can host videos on a $5/month shared server, with software to handle things like video conversion.

Youtube pivoted from "just" hosting videos to a community though, to the point where you won't get any views unless you are on youtube and play by their rules and network effects.

Depends on the videos, I think if you want someone to watch your 1080p@60fps without stutter like they do on youtube anywhere in the world you need edge architecture designed for video no? If so, I'd like to know the service which can do that for $5.

For static video you pretty much just need to serve it in a format browsers support with the correct MIME types, and make sure you have enough bandwidth.

Where it gets hairy is when you want to do live streaming…

Any suggested tech stack for this? I posted a similar question to this recently: https://news.ycombinator.com/item?id=34384732

> tech stack

linux?

a $5 vps running any webserver and an sftp client on your phone will do.

This really doesn't work very well for a great many users.

You can have all the bandwidth in the world, but the magic that Youtube does is mainly dealing with the users' bandwidth, for example, it switches video resolution on the fly when it notices that frames are going to have to be dropped soon.

If only browsers would natively support adaptive quality video streaming. Perhaps we should ask the biggest browser vendor to implement that, surely they won't have any conflict of interest there.

No, that sort of thing only matters if you're going to have a lot of people watching the video.

Hosting isn't the important part. Discoverability is.

This severly underestimates the resources required to serve video to even small audiences.

Depends on the resolution. For short-ish clips with reasonable sizes it is not that much at all - as can be seen with the Fediverse as well as commercial social networks all having their own video hosting.

Just to explain this a bit:

> to put URLs in the descriptions [...] Phone number "verification" is nasty

Spam is a huge problem for any large platform with free accounts, and there aren't a lot of good options to prevent it. One set of mitigations is around increasing the cost of an identity. Email addresses are infinite and free, but working phone numbers are limited and usually cost money. So gating spammer-desired activities on phone numbers makes sense from their perspective. They could get a similar effect by requiring a credit card number, but people hate that even more.

If you'd like to work around this, I'd suggest getting another number for just this. Google Voice will give you one for free, and the Burner app will do it for $5/month if you sign up via web. Or in my case, my ISP gives me a free landline number with my internet service, which is great for this sort of thing.

Jumping through hops like this is a bad idea. If you disagree with their business practices don’t use them.

Beyond the moral argument, it’s easy to be in a situation where you get locked out because you no longer have access to a temporary phone number etc.

I get your point, but I have to pick my battles. I disagree with quite a lot of business practices. If I wanted ethical purity under capitalism, in short order I'd be subsistence farming and living the grim life of a preindustrial peasant. Which would be then giving up any power I might have to change the system. That strikes me as even less ethical, however pure it might be.

Heck, if I wanted ethical purity, I wouldn't be here contributing free content to YC. But I think the net good outweighs the net harm, so here I am.

> Email addresses are infinite and free, but working phone numbers are limited and usually cost money.

In many parts of the world, getting a phone number requires recording your government ID with the carrier (and burners are illegal, though usually for the carrier not the consumer), so the calculus then becomes “to prove you’re not a spammer, give up everything about your identity that was or ever will be known”. Which, no.

(There’s a reason why Russian democracy activists are divided between a “use Signal, everybody else is dodgy as all get out” camp and a “fuck no, don’t use Signal, doxxing you will be slipping $20 to a random SIM card salesman” camp. But parts of Western Europe are the same, and some are even ahead on e.g. unavailability of anonymous stored-value cards for transport or mandating testimony against yourself wrt encrypted storage.)

Four points:

1. Despite this, spam thrives on Google.

2. What happened to using AI to fight spam? Trained and intelligent humans can discern spam without knowing identity.

3. This still won’t prevent other email providers sending spam to Gmail.

4. Safety is often used as justification for more $$$.

That 5th ammendment is great isn't it. I wish we had it.

Services that require a phone number often will not accept a VOIP or a POTS landline phone number, only mobile numbers with txt capabilities.

They also often don't even support MVNOs. E.g. Blizzard not supporting Cricket numbers for account registration

This is somewhat of a bullshit argument. Not on your part! But on those who typically use it as justification.

Because there are two independent components to such a system: {increase cost of identity} + {protect privacy of identity}

When it's offered/justified to combat spam... the implication is that the solution will deliver both promises.

In reality, the first (concept of identity) gets built, marketing/sales realizes they can abuse the hell out of it for their ends, the second (privacy protection) gets overruled at the VP/C* level, and any privacy protections are quietly never implemented.

This happens again. And again. And again.

Google is probably the best case ethical scenario here, in regards to having standards around privacy data stewardship, and even they abuse it frequently when the profit is too large to ignore.

The only reasonable takeaway is that any system that permits mass tracking is too dangerous to privacy to allow to exist, and all should be opposed.

Or, as GDPR does, render companies liable for omissions from a privacy perspective.

You're ignoring the fact that this person has had a youtube account since 2006. That should count for something.

That is another possible mitigation, but is also not a perfect one. Valuing old accounts increases the incentive to steal old accounts and to create sleeper spam accounts that you let age until you're past the bar.

Ignoring the good in pursuit of the perfect is a cause of many ills. Consider the gross loss of trust when someone who has had an account for 16 years, almost since the establishment of the platform, is treated with suspicion. Businesses owe some accountability to their customers, including free users whose data they sell.

Advertising and tracking a bigger problems than spam IMO.

The most ridiculous part of this phone-verification BS is that many companies (e.g. Twitter, Discord) let you create an account without it but will then demand a number at some point later. This only hurts real users because spammers can just switch IPs and create a new account that they can use for a while.

> Google Voice will give you one for free

And what information do you have to give Google for that number so that you can avoid giving your phone number to Google?

https://github.com/google/libphonenumber/blob/master/FALSEHO...

> 1. Some people do not own phones, or do not wish to provide you with their telephone number when asked. Do not require a user to provide a phone number unless it is essential, and whenever possible try to provide a fallback to accommodate these users.

What a bunch of hypocrites.

> Do not require a user to provide a phone number unless it is essential

And note that a phone number is the number for calling a telephone, not some jumped-up pager. They want a mobile number so they can send you SMS messages. I hate SMS, and I deplore it's use as a part of any kind of security protocol.

If you don't intend to speak to me, you don't need my phone number. If you do, then my (VOIP) landline will serve you fine.

> If you don't intend to speak to me, you don't need my phone number.

I would amend that just a little: If I don't intend to have you speak to me, you don't need my phone number.

> What a bunch of hypocrites.

Is "your policies must be fully consistent with any advice given in any of your open source repos" really a standard we should hold big companies to? Because if we treat open-sourcing a text file of recommendations as the company making a statement or commitment to that effect, companies will be way more limited in what they allow their engineers to make public this way. With chilling effects that go beyond semi-humorous recommendations. ("Do you really want to try to open-source this library? You know how frustrating Legal and PR can be to deal with...")

> chilling effects

I don't think that term means what you think it means.

I'm using it metaphorically here, perhaps inappropriately.

What I'm trying to say is that there is a thing that is positive and we'd like to see more of (companies releasing things as open source) and there is an adjacent thing that we are considering pushing back against (companies including things in their repos which conflict with their actions). While it should be possible to discourage only the latter, in practice the effect would spill over to the former.

I don't think we should avoid calling out companies for their bs even if that means they might avoid doing some other less shitty things.

I think calling them out is fine! If a company has a harmful policy, definitely go ahead and say so. I'm specifically objecting here to calling them out as hypocrites, for having a policy that is in conflict with advice in one of their open source repos.

> I suppose this is the end of my almost 2 decades of using youtube to host videos.

As a user I can only hope that more people do stop using YouTube, preferrably choosing something that serves video files directly instead.

> As for email spam prevention, I've run my own mailserver with a domain since 2011. I give each service an actual unique email address and then just catch-all emails sent to my domain. It works great.

This works but only because running your own mail server is too uncommon for anyone to care about. If it was more common, the advertisers or other privacy violators would specifically check for catch-all domains and then strip the entire local part of the email for your user id.

My solution to this is to always use '+' email addresses - IE: "fabs+hulu@domain.com" - and I filter out all e-mails that don't have the '+' suffix as the recipient.

This way dropping the suffix drops those e-mails in my spam folder. Them normalizing the address makes my spam filter more efficient - and I would like to thank them for it.

It's not about sending email. They hash the normalized email and use the hash to track activity across websites and services to build user profiles for real-time ad bids.

Fancy that, this requires an explicit opt in by GDPR.

That hasn't stopped them before: https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-eu...

And of course with such a small fine it's basically guaranteed they will continue breaching it since it makes them way more money.

In theory yes; in practice, they'll track you anyway because it's not a crime unless you're found out, sued, and don't survive the lawsuit.

I'm sure there's a lot of "underground" data transactions happening where the source of data is obfuscated.

Facebook (of all places!) is one of the few companies that makes this transparent.

If you have a Facebook account, and live in GDPR-land, go check which companies illegally passed on your data (https://www.facebook.com/adpreferences/ad_settings -> Audience based advertising) and report them!

Step 1 in defending your privacy: Sign up to Facebook and give them your data.

Back when I actually used my Gmail account, I found LOTS of sites that would refuse to accept an email address with a + in it. I attributed this to a mixture of incompetence and active malice.

These days I host my own mail server and use . as the sseparator, which has been working well for years.

more likely the js snippet or regex they C&P from the interwebs disallowed it.

> incompetence

I stopped doing this after I encountered a website that accepted + in the registration form but not the email confirmation.

Them normalizing those addresses will allow them to track you across all involved parties, however.

Careful, if you use that at amazon, it's also completely trivial for amazon to notice and package you up as "@example.com" and flag "@example.com" on a central watchlist so others do the same.

Although a trick could be if you setup your service to run "service+username@example.com" then depending on how they implement their normalization, they'll chop off the username for you and track themselves.

True, they could do that, but I highly doubt that it's a common enough practice for the industry to bother.

And it still has the advantage that I can remove an alias and it's not obvious what the main account it leads to is.

What are you suggesting they would use such a central watchlist for? It's not like they're going to deny service to those who have "amazon" in their email address.

And what kind of centralization are you talking about? Sharing it with other companies? I'm as pessimistic about these things as they come but even to me that seems incredibly unlikely.

The scheme they're designing is for selling ads. Every site using their scheme has a rule to clean gmail addresses (thIs.is.mY.email+extRastUFf@gmail.com) to be "thisismyemail@gmail.com" then they hash that clean form to obtain "UNIQUEID#123232". Then they use the hash to ask the ad network "who wants to pay the most to show an ad to UNIQUEID#123232?". All the sites you login to and ad networks they use will know this same id.

If you do something obvious like use amazon@example.com at amazon, you should expect them to add a rule that blah_blah_anything@example.com gets cleaned up to "@example.com"

That can't be avoided short of having a mail service with plentiful full aliases on a shared domain. They could just use the heuristic that unless you're at one of the well known email providers like Gmail, your domain name might be personal and therefore count as part of your global identity, without even considering what comes before the @.

So it doesn't really matter much whether I go with amazon@example.com, or john.random@example.com.

To deal with that for good you'd need a pretty large set of domain names to use for this purpose.

There are already a growing number of services that won't even allow you to sign up unless you have an email at one of the large services. I never noticed until I started using my personal domain to separate work/personal after changing jobs recently.

What are some examples?

I’ve been using my own domain since the late 90s, and I’ve never run into this.

When I tried signing up for the SNL app a few years ago with snlnbc@[mydomain.com], and then [randomnickname]@[mydomain.com], it failed, but then worked with a GMail address.

Which is all kinds of ironic, because I'm old enough to remember when free emails like hotmail.com and gmail.com were rejected by a lot of sites!

From personal experience, "new" Flickr makes it difficult to signup when you use a personal domain versus one of the top 10 known email providers.

> If you do something obvious like use amazon@example.com at amazon, you should expect them to add a rule that blah_blah_anything@example.com gets cleaned up to "@example.com"

It seems like a very error prone thing to do automatically, while reaping little in return for the effort. How much do advertisers stand to gain by adding special case heuristics for "people who might be using an unshared email domain with a per-site local-part?"

If I give my email as me+amazon@gmail.com, normalizing it to me@gmail.com is just applying a bit of common knowledge about how an email service with billion(s?) of users handles the + sign in the local-part of an address. It's a carve out, but it's totally deterministic (for Gmail at least) and applies to a lot of users.

If I give my email as amazon@2d0d4809.com, normalizing it to @2d0d4809.com involves guesswork about that specific domain. I don't think normalizing away the + sign in the first case implies we should expect the latter to get normalized into a single identity as well.

I really don't know anything about the ad space but the linked project seems to indicate that ids get grouped into value classes. It describes IDs built off of normalized emails and also off of phone numbers to create identity-validated IDs which are of higher value in the ad market. Obviously phone numbers will be the most useful of the validated IDs and emails normalized.

Of course if you have "@gmail.com" that's not going to have any value vs the identity-validated alternative. But at the bargain bin end of the ad selling universe does "amazon@2d0d4809.com" that has never been seen anywhere except amazon have more value than "@2d0d4809.com" that has been seen recently in a handful of other places consistent with use by a single person? It's obviously not an identity-validated ID class, so it's not going to demand identity-validated bids. But having a tracking history might add a tiny bit to the bid. So I wouldn't put it past people to use that rule.

I don't even think the Heuristics would need to be that complex. Big email still uses reputation lists to determine if they should junk an email, so applying sender reputation, or lack thereof, to the domain part could be good enough to safely hash as an identity.

If you control your own email, you can set a character other than ‘+’. (For postfix and dovecot, look up `recipient_delimiter`.)

I setup a sequence of letters which makes it completely unobvious for anyone who doesn't know the sequence

If you own your own domain, it's trivial for them to notice that it's a vanity domain for a single user or small group. The only way to hide is to have thousands of friends with diverse interests using your domain.

Trivial to a human looking at the data set, but it's something the algorithm would have to be trained to recognize.

Not really - in practice the tracking system can have a list of email providers and treat every other domain as one user (especially ones with catch-all setups).

I don't think it's trivial at all? I sign up with random first names and last names, my email address doesn't have the actual company name and I don't think there's that many people with vanity domains to justify adding code to track this use case.

For historical reasons I use a dash. This works just fine 99+% of the time, but very rarely a site will not allow a dash in emails.

Thank you - finally someone who knows that it was always a dash.

What do you mean? What was "it"? Subaddressing semantics has always been at the discretion of the email service provider.

As far as I know, subaddressing was invented as part of qmail, which used a dash: https://en.wikipedia.org/wiki/Qmail#Innovations

Fastmail supports subdomain addressing, such that instead of "user+service@domain.com" you would use "service@user.subdomain.com", which will forward the message to "user@subdomain.com" and even file it into a folder for "service".

You can also create free aliases on a completely different domain, and I think they have a plugin with 1Password to do this for each login you create.

Isn't it up to the email provider whether `+` and `.` are ignored in email addresses, won't removing them to "normalize" end up sometimes mapping different email addresses to the same identifier?

I guess maybe that edge case is not nearly as bad for the advertisers as failing to link the same person, so it's tolerable?

Afaik the period thing is a Gmail thing while the plus thing is in the RFC.

However it appears the IAB UID2 README says to only normalize pluses/periods for gmail.com addresses: https://github.com/IABTechLab/uid2docs/blob/main/api/README....

There is an RFC but it just mentions + as an example of a possible sub-address separator when discussing sub-addresses in Sieve filters. Whether or not + acts as a sub-address separator is server-dependent.

Oh good find, of course they can make a special rule for gmail, which is such a large portion of email addresses it's worth it.

It’s even up to the email provider to make the local part completely or partially case-sensitive if they wish, but tell that to most government websites in the world. Probably a lost case at this point.

Periods are more of a Gmail-specific thing, but as you mention merging two people once in a blue moon is not a terrible price to pay for an analytics system, it’s not like it’s going to send mail to these addresses.

On my own host, a '_' was easily configured. Maybe these companies will normalize everything, but it works for me.

That's why for Firefox Relay [1], we recommend using random email masks, and why I use it over my own catch-all domain for unimportant things.

We do support your own catch-all subdomain, but that is just to cover the use case of having to come up with an email mask on-the-spot. If you are filling in a web form, best to use an email address that looks exactly like the email addresses of other Relay users.

[1] https://relay.firefox.com/

This seems handy, particularly the phone number part. Reminds me of the privacy credit card system, though their backend is privacy compromised.

Yep, credit cards are definitely of interest to us too, but unfortunately we haven't been able to find a way to do so in a privacy-friendly manner yet, which is the entire point.

This. Have been doing this for years as whilst it's been very handy to prevent password leakage etc, it's also very interesting to see where my spam comes from; facebook@ is the biggest culprit.

LinkedIn, too. I get a bunch of recruiter spam addressed to my old LinkedIn email that was probably compromised in the big hack/scraping incident from a few years back. Good way to flag the sketchiest recruiters.

> It seemed to be completely obvious to me even decades back, that the + scheme would be trivially parsed and reversed.

I was expecting to see that, too but in more than 15 years of running my own mailserver i don't think i have had an attacker that has removed the suffix when trying to phish me. These attacks are automated. Your address is just one of many that is being harvested and sold to someone else who conducts the phishing campaign.

> just keep on making completely new aliases

The problem with most of those tricks is that they can be countered in some way, so I feel this is one of the areas where your security has to rely to some extent on obscurity (or the fact that it's too rare in the wild to be worth countering).

But I do have a question, have you found a programmatic way to create aliases / a provider that offers an API for that? Because that seems like one of the main usability downsides to your approach.

Re: phone numbers, the blocking of google voice style numbers is pretty dirty. Even openai requires a number that supports advertising in order to sign up for ChatGPT.

I do the alias thing, but I've been getting spam email lately that simply doesn't have my email anywhere within it, and I'm not sure how to deal with it. Honestly I'd expect it to be dropped at somewhere in the pipeline, but I can't find an option to deal with it in Thunderbird at the least.

The raw email received almost certainly does have your email in it. Your problem is your client isn't displaying it to you. In fact email has a lot of redundant information in it to administrators debug problems, and just about all of it won't be displayed by your typical email client as it would be confusing to most people.

Some clients will display the "raw, as received" email if you ask them too. GMail has a "Show Original" menu item for example. In there, you will find "Received: ... for <XXXXXX@gmail.com>". The exact form does vary between systems, but it's almost always there.

No, I checked the source and my email didn't appear anywhere.

Well, I can't find the email now and none of the other spam I checked did that. I swear I triple checked, but maybe it was just my imagination.

Its up to the receiving mail server to add the RCPT TO and other enveleope information to the delivered mail.

Also, the character that might be used to delineate aliases can be defined, at least if you have control of the email host. Some hosts will complain about their name as part of the email address, but usually some near-match will suffice.

I’ve used <targetdomain>@<mydomain> for 2 decades now. It eliminates the risk of password leaks and let’s me know who gives away my email addresses.

That it also prevents ad tracking is even better.

I've used spamex[0], for a couple of decades, I think.

[0] https://www.spamex.com

>The bigger issue I see is the desire to link everything to a phone number. Even stuff made for privacy, like Signal

I have a throwaway SIM for that

I don't use Signal for this reason. The fork Session does away with it, albeit they're backed by a crypto startup.

VoIP numbers are cheap.

how big is the website? ignore everything before @

Reply on news.ycombinator.com