Hacker News Reader

Comment by simojo | Hacker News Reader

There are online services where a bad actor can enter your email to automatically sign you up for hundreds, thousands of marketing emails. In the event that that happens, given that you have full control over the domain, you could just divert whatever <x>@yourdomain.com to a black hole. What will happen when email attacks become more advanced--to the point of signing up thousands of different <x'>@yourdomain.com? What strategy would one have then? You would most certainly have to part ways with that domain.

The author makes a good point, your email address is (arguably) more important than your home address. Perhaps there already are, but I hope for better safeguards against these kinds of attacks.

View on HN

I already am in that situation. Like onions and Ogres, my email defense is in layers.

1. Specific known compromised TO addresses are sent to devnull.

2. Specific FROM senders are whitelisted.

3. Three or sometimes four heuristics engines evaluate. If any of them pass the mail, it goes to a separate new-senders inbox. I thus get maybe a dozen spam messages per week in that box - and five figures of messages rejected.

I used to tweak it a lot, now I just occasionally add another FROM address to the whitelist.

Someone did this with my main real world Gmail address. I am still fighting it by periodically dropping from the spam lists I was recently added to.

We need a law that just like you are required to let people drop from a mailing list, there's a law requiring one ack or click on a link to join a list. I always get on legit lists that will stop once I request. But in a month I get 100+ new lists often sending me 10-50 messages a day.

For every crucial service (banking, etc), generate a unique, cryptographically-strong email address, save it to your password manager, and have its mail forwarded to your common inbox. If only phone numbers were so easy to mask.

1) what does it mean for an email *address* to be cryptographically strong?

2) in case of hard to remember address, what do you do if asked to write it down with no access to your records? (It happened to me once before)

> what does it mean for an email address* to be cryptographically strong?*

Something someone couldn’t guess, like:

<uuid>@domain.com

c4694056-63dd-476f-9823-2548aa3d754a@domain.com

> in case of hard to remember address, what do you do if asked to write it down with no access to your records?

It’s a tradeoff. You’d probably want to use the cryptographically secure addresses sparingly.

Another option would be to use your password manager to create a “memorable” password, which is usually multiple random words, like:

essay-curve-white-cable@domain.com

But again there’s only so many of these you’ll memorize, so use sparingly. Compare it to the cost of just changing the email. Maybe with a bank it’s more work and risk, so it’s worth the added effort, but if it’s the email you use to order pizza, just change it.

Why are we doing this exactly?

There’s an attack where you get signed up for mass marketing emails and your mailbox gets flooded with emails from mostly legitimate companies.

Say someone gets into an account you use to purchase stuff (Amazon, etc), but they don’t have access to your email account. They sign you up for this mail flood, then start buying stuff with your Amazon account, and legitimate notifications of purchases are lost in the noise with many thousands of emails from everything from Apple to Chuck’s Boat Rentals.

Using a unique and unguessable email lowers the chances of a more important account being affected (obviously at some point we’re splitting hairs).

I'm missing what purpose the high entropy alias does; from your description the attacker knows the email address and can still sign you up for mail flood?

I think the idea is your mail server is set to only accept emails to account names you’ve generated instead of being a catch all. So if one of the ones you generated is used for spam, you could just deactivate that one and move the service that email was associated with to a new generated email. and because there’s no catch all, an attacker can’t just sign up literallyanythingrandom@example.com with dozens or hundreds of different emails.

64 random hexadecimalish character address, eg d41d8cd98f00b204e9800998ecf8427e@example.com

2) Yes, this is a problem.

This happened to me! Can I go to these services and turn it off, like remove my name from these spam lists? Please point me to this.

About once a month I go and drop myself from the latest lists. There are many magazines and whatnot where you can sign someone up for 100+ mails a day. Only a very few of them send you a message you have to ack to start the flood. Most just start the firehose without checking.

I'd like to hear what other people do to address this.

Reply on news.ycombinator.com