Hacker News Reader

Comment by hereme888 | Hacker News Reader

email aliases are the only real protection I've ever found. Fastmail offers almost unlimited aliases, and throwaway addresses. Others are starting to do it.

I doubt gmail will ever offer aliases or similar protections.

View on HN

It's sad because all the new "private emails" like Tuta only offer a very limited number of aliases. Legit throwaway addresses offer a good compromise between privacy and security.

> try to count how many times you clicked “Delete” on junk or unwanted inbox messages

I don't understand that sentence in the article though. I click on "report spam" every time because that's what it is, even if it's a legitimate business that I used in the past. They use dark patterns to make you subscribe, but it's not honest, therefore -> spam.

“Spam” as a neologism doesn’t have a widely agreed upon shared definition. The most apt would seem to be “email I don’t want”. But that’s not too helpful when third party gatekeepers are trying to mass assign status to an email. The same email could be unwanted by one person and very gratefully received by the next.

My standard definition is "email from a sender not in my whitelist"

My employer demands I refer to this now as an "Allow List" and "Deny List', no more white list or black list, master drives or slave drives.

Tuta lets you use a catchall. The alias limitation only applies if you want to send mail as the alias.

Gmail has aliases that have a + in them, e.g. foo@gmail.com -> foo+bar@gmail.com. I use them for subscriptions: foo+substack@gmail.com, etc.

So if you provide address+suffix@gmail.com, the spammers know that address@gmail.com is a legit address.

Yes, but only if they're bothering to do that level of checking.

I would guess that that's pretty rare, as not many people know about this trick.

I thought this was commonly known, particularly in the mass mailing marketing industry.

This type of pattern is very easy to scrub if you had a list of email addresses.

I have an anecdotal evidence inside my own inbox that this behavior is happening. You aren’t buying security from anything but the lazy and ignorant spammers.

Agreed. This tactic is so overused that spammers have caught on for quite awhile

I don't use email anymore, but the last few years I did was only possible because I owned a domain name and had a catch-all set up.

You can then immediately isolate any bad actors, and don't have to rely upon a `+` sign (easily filtered) to "differentiate" email addresses. More-commonly-used logins can then be preliminarily filtered to separate internal email accounts (e.g. known-junk can be sent to rarely-accessed account; family contacts can be sent to notifications).

I primarily use a @duck.com alias that forwards to my gmail account.

It's easy to generate random new @duck.com aliases for the primary.

I have a browser plugin (mobile and desktop) that recognizes email form fields and offers to generate a new random @duck.com alias for the field.

When an alias starts to receive spam, I disable it.

Can't you use youraddress.servicename@gmail.com? I thought gmail strips whatever comes after the dot. (I don't have a google account, so I could be wrong or maybe it was a different character, but I remember reading about it a couple times on here.)

It's "+". The dot is, in fact, transparent.

After the +, not the dot

You're thinking of the + character. youremail+servicename@gmail.com will still be delivered to you.

Gmail ignores dot characters. y.o.u.r.e.m.a.i.l@gmail.com is equivalent to youremail@gmail.com

I believe it strips everything after a "+" so you can use youraddress+servicename@gmail.com.

It ignores periods so you could also use your.address@gmail.com or y.ouraddress@gmail.com or whatever.

Some sides block plus addressing but that's what I use a lot of the time.

I think you mean

yourname+servicename@gmail.com

From my experience, many (bad) websites consider "+" an invalid character and prevent you from using the address in this form.

Smart spammers can just strip the service name since it works the same for all Gmail users.

Really need dedicated addresses like Fastmail's Masked Addresses.

You can have aliases on Gmail if you use Google Workspace (for custom domains), but there's a limit and no support for wildcards. Wish they had those, because then it's very easy to find out who sold your data

You can easily set up a catchall that goes to a group by modifying the default routing rules.

If your workspace domain has multiple users with non-overlapping responsibilities, that isn't very useful.

Reply on news.ycombinator.com