Hacker News Reader

Comment by EvanAnderson | Hacker News Reader

Reading that thread was painful. I always use custom one-off email addresses for services I sign-up for and. When I've attempted to report disclosure of my email address I'm almost always met with major skepticism. It's maddening.

I used to enjoy the reactions I'd get from store clerks and telephone reps when I give them my email address. "Oh, how you have an email address with our company name in it?" In recent years the reactions have turned kinda hostile, "What is your connection with our company?" and once "You can't have our company name in your email address." I gave up fighting and now I just use random strings.

View on HN

Wow. That sounded a lot like I wrote it. Sounds like the same story line I've experienced. :)

If I'm at Toys R Us or something, I'll just be like uh... "tru25@<mydomain>.com" so they don't question me. (Also, I chose Toys R Us as an example because when I went to sign up for a loyalty program, and they typed in "toysrus@<mydomain>.com" their cash register black screened and rebooted... !)

Acme Inc's employees being suspicious of people with "acme" in their email address is probably, on the whole, a good thing. It smells like a phishing scam to people who don't know about throwaways.

I recently had to sit through a customer rep read a 32 character long alphanumspecial email address out to me for "security reasons". Bet she was glad I didn't use usicode.

You might consider just picking one or two random words from the dictionary.

That sounds like a fun idea for an app/service. You provide it with your base email address or custom domain and it generates a couple random words and keeps track of what service you used it to sign up for.

I spent a little time thinking about this concept and how it relates to just having dummy account you control, for giving to services you don't fully trust.

As long as you use a secure password, and you don't use the same one. I don't see alot of difference, but the ability to sandbox each service to a list of email accounts, so that the attacker never knows the master account, would be an extra layer of security.

Utility exists here. I just don't think there's enough utility to justify the work.

A better option might be integrating it into LastPass or 1Password. They already generate a random password for you, why not an email address as well?

I use something similar already. I've a domain that is used purely for my email. Normal addresses like webmaster@ are rejected. A script on the server takes the domain I am registering for a service on (eg "google.com"), generates an random-looking but deterministic address, and creates an alias for that address to my real inbox.

End result is that everyone gets a unique email that can't be guessed, I can nuke an address as soon as it starts sending me spam (often) and my true inbox is typically completely clean.

I initially made the mistake of trusting my bank and utility billing systems with my real address. Turns out my power company had their database compromised, and when I called to inform them they refused to believe me (like Dropbox).

A good five years ago I got two phishing emails to two unique addresses that I had used to contact a local bank. They also refused to believe me, and it was basically my fault for not securing my computer. Somehow.

Well that's terrifying.

That's what rot13 was created for.

dropbox email -> qebcobk@yourdomain.com

I just tell them it makes it easier for me to find their e-mails.

It is actually possible that you violate their tos by doing so - it could be construed as falsely implying some representation of the company. A stretch to any sane person, though any typical terms document contains miles and miles of cya.

Reply on news.ycombinator.com