Hacker News Reader

Comment by hnbear | Hacker News Reader

Currently I use Fastmail to host my own domain, and then for every new service I save the account in 1Password using service@service.mydomain.com

It's a bit extreme, but surprisingly little extra effort. That said, most of the accounts I create are throwaway.

For phone numbers I have an old, unused Google voice number I give out. It's a real number, but never checked, except for once every 90? days, to keep it active.

I'd love it if OnePassword integrated with something like https://randomuser.me to generate a new profile for every awful service that needs an account to work.

View on HN

I've been thinking of running a setup like this specifically to rat out who's been selling my e-mail addresses, since the spam would be directed at the service@service.mydomain.com.

Did you find any interesting results from your setup? Some surprising services who sold your address?

And did you find you got much spam to non-existent addresses? I used to use a catch-all setup, and got a large amount of spam, but that must have been 25ish years ago.

Very little.

Could also be that Fastmail has good filtering.

Thanks. I find Fastmail a little worse than Google in terms of spam, but that could just be fluctuations in the amount of spam in general after changing service. (I'm noticing more spam in my work email recently, which uses Google Workspace, too).

Actually, I think it's only happened once or twice in years. I was expecting more spam than I get.

Could also be that random domains aren't that valuable to sell.

Not GP but I have the same set up and have only had a couple times where I received unexpected emails to an inbox. One was from GitHub profile scraping, can't remember what the other one was.

One of the surprisingly useful areas is with deliveries. Emails from delivery companies (especially from abroad) often don't specify what it is they're delivering or who it's from. But with this set up I can easily check that with the email address they're sending to, to know who it's from

Can confirm, I'm using the same fastmail setup, same strategy using service@... and no complaints and no spam.

I also use catch-all and no noticeable increase in spam.

name+service@email.com is also a good way to find out. It’s standard and accepted by most sites and most email providers. I use it, didn’t find any proof of service selling my adress except some random Ali express vendor the one and only time I bought here an item I couldn’t find anywhere.

That mechanism is so well known, it’s trivial to undo by removing the +service part. Is it really effective? How would you even find out if it is?

Good point. I'm not sure the bad guys take time to clean the base or even care. But for sure the edgy/grey area one would. Still, i'm more confident about this solution than relay emails from any service (even Firefox) that could potentially lock me out eventually.

Is your intent privacy?

I've thought through similar setups, but if the intent is to break cross-platform correlation to a user/device ID and related de-anonymization, I keep coming back to these questions:

- How do I know fastmail doesn't sell data? If every one-time domain is tied to a static fastmail account, and the fastmail account has my real info and sells it, then the obfuscation per-service is moot.

- Google certainly is selling data, and its hard to have an account with them that's totally clean and doesn't need an existing "anchored"/tracked piece of infra to set it up (existing phone number, etc). SO, the VOIP number from Google is once again linked up to my IRL data, and the obfuscation is again moot.

The best I can think of is the theory that a LLC's privacy protections will be stronger than an individual. If I wrap everything in a LLC (phone provider, AWS acc with services like Chime, etc), then the correlation surface areas looks like a random LLC using all these retail services and its delinked from my IRL, assuming AWS/Google don't protect a LLC's data from selling into adtech (and I speculate it might protect it actually).

I owned and ran my own email domain for a long time. Initially on my own hardware for fun, then a VPS, then GSuite, then Fastmail. That's over around 20 years.

So, it wasn't planned - it evolved. Somewhere in the Fastmail era I was reading their docs around wildcarding and thought I'd try it out.

My primary domain is my name though, so for extra privacy (anality) I bought another that has no link to me in the name.

There are still gaps in it. e.g. any merchant site still needs my physical address, and plenty need my cell number. But, generally, it's just an attempt to minimize a digital footprint and see what privacy I can get.

That and just why not? I self-host enough stuff, that I see this as another aspect of the same mentality - having a little more control.

It's not perfect security, it's not completely clean. Hopefully it's enough to get me out of the easy target bucket though.

Makes sense, seems like this setup still has the same issues I brought up, but good to know others are sorting through the same issue.

I spent a good while reading about adtech from the practitioner side (i.e. adtech devs) vs. from the privacy side, and it was illuminating. Basically, the fears of privacy advocates get laid out in plain "this is a great feature for user correlation" speak, without any of the feature-masking used when adtech discusses it in privacy terms with privacy-conscious audiences.

In short, my takeaway from that research was it only takes 1x merchant or infra provider which can correlate a "masked" domain/VOIP number/PO box with something IRL of yours to basically undo the whole privacy effort. Without ironclad knowledge the vendor doesn't sell data (which is hard to get), it's as good as safely assuming the data got sold (or the pixel in the webpage did it, and so on).

Tough to think through! I think LLC'ing ones life, if in the US, is the only way to truly do it or get a reasonably high guarantee. You'd get corporate privacy guarantees which are unfortunately stronger than individual privacy guarantees in the states.

Not quite randomuser.me, but 1Password integrates with Fastmail to generate masked emails on the fly.

https://1password.com/fastmail/

Yeah, I tried that for a while, and I have some Apple generated forwarders too.

In the end in places like a store that wants you to sign-up for X% off, or something it's easier to just to give them storename@domain.com and see what happens.

It's actually pretty low friction in terms of management.

As I said elsewhere in the comments here, I didn't like the xxx.xxx@fastmail.com format of masked emails because if you're using a custom domain and you have 200 logins using masked email addresses, then want to change your email service, you have go through those 200 services updating the email address for each one. I'm trying the same setup as you suggest above on the basis that Fastmail allows you to block specific email addresses in case you start getting lots of spam to a specific address through the catch-all.

Yes, custom domain future proofs it. You can route that domain’s email to any servers via MX records.

I have put in some blocks before where services don’t let you unsubscribe.

Would one problem with your domain approach be that it’s less anonymous to mailers than if you used a relay services where many users with random email addresses shared the same relay domain?

Your own domain helps zero to prevent linking your activity across sites.

Fastmail masked emails + 1Password helps though.

Of course it does, nobody will take into account the special case of people who use subdomains or even just non-standard email address separators, unless they are a rather determined government agency and then all of a sudden almost no method works anymore for privacy.

I'm pretty sure even Google doesn't care about the dozens of people who use a different email address for different services.

This was my thinking here - yes, it has flaws in the approach, but it also gets me out of the main buckets that spammers will hit, and ad brokers will generally be selling.

It's a little friction, that maybe goes a long way. Pretty hard to actually evaluate though. Gives me the warm and fuzzies and I got to play around setting it up, so all good there.

How do you set your domain on fast mail to use @.domain.com? I only know @.

(I'm using wrong terminology) It works because if there is no entry for *.domain.com the system will go one level up, to domain.com for the MX records.

It even works multi-level, like x.y.domain.com will use the MX records of domain.com (provided there are none for x & y).

This is worth mentioning as x.y.domain.com does not work if you have a *.domain.com SSL certificate.

Really? Cool. Would you be comfortable sharing your dns settings and or fastmail domain settings? Cool if no but I wanna give this a go!

I don't use fastmail. I use Office365.

It seems that fastmail only does *.domain.com and not *.*.domain.com: https://www.fastmail.help/hc/en-us/articles/360060591053-Plu...

Hope that helps

Reply on news.ycombinator.com