Hacker News Reader

Comment by stackskipton | Hacker News Reader

>However, until such data breaches regularly lead to severe outcomes for subjects whose data was leaked, and those outcomes can be causally linked to the breaches in an indisputable manner

Which means nothing gets done because it's pretty hard to prove where any one misusing your information got it from. My identity was stolen after breach but when I took it up with entity that lost my information, they were like "Prove it" which of course I couldn't because people who did it to me were never caught.

View on HN

I own my email domain, and I register for each service with a different address. For example, flightaware-20240817@mydomain.net. This way, I know where my email addresses leak from.

With some email services including Gmail and Protonmail you can add +whatever to your username part of the email address to get the same result. My name+flightaware@gmail.com for example…

And many mail hosting services let you assign a catch-all, which allows you to simply use anything@mydomain.com to get the same result.

The former would seem ineffective, surely anyone buying such a dataset would just remove the "+___" part in emails that have them?

Why would they bother?

To limit evidence of culpability in the event of a data leak exactly like the one we’re discussing.

Why would the hacker care about that?

Because they assume you've set name+spam@gmail.com to be filtered directly to spam, and they can easily evade those filters by removing the ±spam part.

Big companies do this. I have signed up for things using a +filter email address, only to receive the emails from that company that is signed up to get at my plane address, without the +filter part.

Because the overwhelming number of people with “+” in their email address are unlikely to click on spam.

what's important in "anything", if you can, is name, company, and some pseudorandom chars. Because company@example.com or name+company@example.com is easy enough to guess, but pseudorand_name_company_kroj38@example.com isn't plausibly going to get guessed at.

Enough sites don't accept + in the address.

Even if you can enter it, various backends in the same company might not handle it correctly and you enter up with an half-working account that their customer support (if they even have that...) cannot solve. Been there, tried that...

Personally I have - as the separator (not on gmail or similar). If you have to give you email on the phone it can cause lengthy discussions why their company name appears in my email address..

Is that still the case though? I use plus addressing everywhere and works fine for me so far.

I haven't had issues with it in many years.

Don't know. Last time I experienced problems was when entering a family members gmail address with a plus sign to share my newspaper subscription. They could not use it and I could not remove it... That was about 5 years ago. Have been burned too often, don't try it anymore.

They didn't spam me, they tried to sign up with a bunch of credit services. Yes, X lost my data, it's getting proof that X data loss where was scammers acquired my data from.

I do the same but some service provider forbid you to put the name of the company in the mail. That's among those stupid security rules (one of the most stupid is MS Xbox service preventing you to have letter from your email in your password. So if you are using a@xxxxx.com and your password generator use a, it will get rejected….

I’m not sure what the point of this is other than a nerd flex?

Okay. So now you, individually, may be able to attribute some sort of responsibility in some sort of civil action.

Penalties that companies care about aren’t going to be built around some very non-standard individual’s ability to maybe, sometimes, attribute blame.

Plus, the real damaging stuff wont have anything to do with your email addresses.

Reply on news.ycombinator.com