Comment by Someone1234 | Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Parent Full thread

The US really needs something akin to the EU's Data Protection Directive[0].

I've seen tons of businesses hide some tiny clause in their T&Cs (page 30, subsection 15, paragraph 11, etc) which allows them to resell your data to whoever will pay. For example the National Geographic Store sold my personal data when I purchased something from them (even with no check-box opt out, etc during checkout), and I've been receiving girly catalogues and credit card applicaton snail mail ever since (with a glaring typo which points right to National Geo's store).

I don't really see that happening (the US getting better data protections) as the US constitution is being largely used to protect business's "freedom [to do whatever the hell they want]" rather than individuals/people as was intended.

I was really hopeful that when the blackmail criminal-record racket started that that might finally result in substantial changes within the US, but nope. Nothing has changed and the blackmailers still operate.

[0] https://en.wikipedia.org/wiki/Data_Protection_Directive

Note that a lot of the information being discussed is public information in the US though. Companies aggregate this information--often for a fee--but it's public by law. To take just one example that struck a lot of people as surprising when it became a topic during the last US election, in many states it's a matter of public record whether you vote or not (not who you vote for but whether you vote). And there are many, many other examples.

Historically, uncovering this information would have meant spending many hours going through files at county or town clerks--which put a very real limit on how widely it would be used. Now much of it is digitized (and aggregated). So at least part of today's issue isn't so much that private information is being made public but that ostensibly public information is now such much easier to access and cross-reference.

I know you can enter email addresses as x+y@example.com where x=your regular email and y=some word/phrase to indicate who might have sold your email.

For example, if you register bill+NG@example.com with national geographic, and you find yourself getting to: bill+NG@example.com from spam, you know who sold your info. My question is, do you think companies know this trick and just remove the portion following the "+"?

> if you register bill+NG@email.com

Please use the second level domain label example[1] when writing examples of email addresses. For all you know, you just posted someone's email address.

[1] http://en.wikipedia.org/wiki/Example.com

Changed it even though someone else pointed out it bounces. Thanks for the tip.

There's nothing special about + as far as email in general is concerned, that's just a convention some mail servers (such as gmail) use. Any server using qmail, for example, uses '-' for the same purpose, but + can be part of a full name there.

While cutting out the + might still get your mail to gmail users, there's no guarantee it would for anyone else. I don't really think the people doing the spamming care, and they'd rather it arrive in an account at all than burn their sources.

Yeah you'd be surprised how many websites don't accept email addresses containing +.

Most of the time when I try to use this it just doesn't accept the email address. I've wondered if they sincerely don't think that's a valid email address or if they're intentionally thwarting that strategy.

I doubt it's intentional. Most common validation regexs that your average web dev would use tend to reject the + character.

Personally I self host a domain that accepts anything@ and file it into a special inbox. This lets me give real addresses to specific sites and blacklist them as needed.

I did that, until I got the second run of someone sending spam to [dictionary]@mydomain.

Luckily this hasn't happened yet. Last time someone spammed my "throw away" domain I just took it offline (killed DNS) for a few days, that seemed to work :P

I hope you're doing anything@subdomain.example.com otherwise you'll get catchall spam.

Surprisingly, I haven't been getting catchall spam. If that happens I'll just write a quick interface to add permitted stuff through easily or just create a pattern that catchall won't use :)

We had a meeting about privacy at work and the presenter told a story about his ISP who messed up his name when he signed up something like Roge rJones instead of Roger Jones. The ISP stated they do not sell customer information to 3rd parties.

Within a week after signing up he was getting spam and junk mail addressed to Mr. Roge rJones just copied and pasted right from the ISP customer database.

Indirectly in a way what you say to try, a unique identifier.

I get junk mail for Mr qweqwe asdasd a lot as confirmation of your point :)

Spam companies knows it but don't really care I suppose, it's not their problem. Your problem is that if you forget the password you must remember if and how you personalized the e-mail address to reset it.

Look in any email they sent to your gmail account, then "view original."

That does only work with Gmail, doesn't it? I don't think this is that widespread yet, so few companies (if any) will remove the part after the plus.

It works with many mailservers, on postfix it's called recipient_delimiter. It's enabled on dreamhost as + as far as I know.

The amount of spam/phishing I'm getting to me-macromedia@ and me-adobe@ is pretty amazing. Guess I was part of _that_ breach.

I'm not sure I'd go through that if I were doing it again. I've got hundreds of those emails out there, and being able to just drop some of them hasn't been the help that I would have hoped for.

That doesn't work with Yahoo! Mail.

The odd thing is that Canada's version of a data privacy act, PIPEDA, was enacted 14 years ago (2000) specifically so that people could trust private corporations with their data while e.g. shopping online [1].

In the end, the problem with these sorts of things is that once people are making millions doing something that should be illegal, they have the resources to ensure that it never becomes illegal.

[1] http://en.wikipedia.org/wiki/Personal_Information_Protection...

Yes. We already have laws that protect a person's likeness by default. All that is necessary is to extend the concept to protecting personal information (of which a likeness is one example) by default. It probably won't happen until large numbers of Americans start valuing their personal information, however.

It's unfortunate that more and more services started blacklisting mailinator.

Last week I have pointed a subdomain (x.example.net) to Mailinator.

I've only used it once so far, but I don't expect many sites to have made the effort to block it.

Reply on news.ycombinator.com