Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: NBox – Sign up anywhere without giving your email address

nbox.notif.me

Post reply on HN
Print view View original

161–170 of 212 posts

Re: Show HN: NBox – Sign up anywhere without giving your email address

#161

Post by joosters »

rsync wrote: post #96
talove wrote: post #95

I've had a catch-all for *@mydomain.com forward to my primary email address for 10+ years. In that time I signed up for services and websites with [domain]@mydomain.com thinking I'd catch all those dirty scoundrels selling my email address and have an easy way to filter unwanted mail. But you know what really happened? I wound up with hard to remember email logins and caught less than a handful of services sharing my…

"But you know what really happened? I wound up with hard to remember email logins and caught less than a handful of services sharing my email address without my permission." Can you elaborate ? I have been meaning to set up just such a mechanism as it has always seemed like a good idea ... It seems like "rsync.net@example.com" would be very easy to remember and associate with the site (rsync.net, in this example) ...

I've been using the same system with my own domain for several years now, and unlike the OP, I've seen many unique emails get on to spammer lists. My blocklist of emails has got quite long!

As you say, using a password manager, or just picking a nameOfService@example.com style of email, means remembering the email addresses is pretty easy. n.b. you may need to also set up your email client to let you send emails with a customisable address too.

Spammers who send stuff to randomAddressTheyMadeUp@example.com can be mostly blocked because these tend to have a messy jumble of text and numbers - I use a simple regex to throw away these kind of spams. I use procmail to do the blocking, but I'm sure there are many other tools that would work just as well.

Re: Show HN: NBox – Sign up anywhere without giving your email address

#162

Post by Jaruzel »

awqrre wrote: post #134
talove wrote: post #95

I've had a catch-all for *@mydomain.com forward to my primary email address for 10+ years. In that time I signed up for services and websites with [domain]@mydomain.com thinking I'd catch all those dirty scoundrels selling my email address and have an easy way to filter unwanted mail. But you know what really happened? I wound up with hard to remember email logins and caught less than a handful of services sharing my…

Doesn't BCC render this solution mostly useless anyways?

The mail has to get to you somehow. The way SMTP works is that there are two places your email address is usually used during email delivery:

1. Before the actual sending of the mail data, the sending server connects to your mail server and after a polite introduction sends 'RCPT TO: xxxx@yyyy.com'. This is where your unique-for-that-site email address is used.

2. Later on during the transmission, all the 'real' mail headers are sent, and this is where the To, From, Subject, and CC headers are set. If you were BCC'd there is no 'BCC' header, so the 'To' header normally has the mail address of the original 'To' recipient. Or in a lot of cases the 'To' header is omitted entirely. Depending on your mail client, you will either see your name in the To field, or something like 'Undisclosed Recipients'.

Spammers typically shake it all up, so that the 'To' header rarely matches the 'RCPT TO:' value.

In my bespoke anti-spam system, I re-inject the 'RCPT TO:' and 'MAIL FROM:' into the mail headers (prefixed with X-) so i can easily see in my client what is actually going on.

Re: Show HN: NBox – Sign up anywhere without giving your email address

#163

Post by bdav24 »

markwakeford wrote: post #107

So a lot of systems these days use email password recovery, is this not just adding another attack vector ?. > bdav24: Hi water42, don't ever trust anyone with your data, governments and big companies get hacked every day. Our angle: we don't ask for any personal information You will be able to route/read all of an individuals inbound mail ?

Hi markwakeford, that's something we're currently working on. All devices that access the account will have to be validated on the previous device(s) and will be displayed.

That said, for targetted attacks we won't be able to do better than Google and others, the risk is never 0.

> You will be able to route/read all of an individuals inbound mail ?

You mean to handle the load? We can scale at any time if we need to, but our current setup can already handle a lot.

Re: Show HN: NBox – Sign up anywhere without giving your email address

#164

Post by chumali »

StavrosK wrote: post #101

I've been using 33mail.com for years for this. I just give it an address like "hackernews@username.33mail.com" and it forwards email. If hackernews ever starts spamming, 33mail gives me a link to block it. I love that service, it's saved me countless headaches.

Blur by Abine offers a similar service, it includes a password manager and the ability to mask phone and card details on the premium version. Generated email addresses can be managed on the site or through the mobile app.

Re: Show HN: NBox – Sign up anywhere without giving your email address

#165

Post by f4rker »

bdav24 wrote: post #2

Hi, I'm David, one of the developers of nBox. nBox generates for you an email address for each site, for free. - Effortlessly thanks to our browser extensions - Addresses are anonymous and private - Delete the addresses you don't want any more - Be notified according to your preferences on each email I'm looking to share the service. Any feedback is very welcome. Thanks!

>Effortlessly thanks to our browser extensions

That's pretty cool

Re: Show HN: NBox – Sign up anywhere without giving your email address

#166

Post by sleepychu »

kinkrtyavimoodh wrote: post #133
Sohcahtoa82 wrote: post #113

Earlier quoted context omitted.

I did that, too. Used a catch-all and just subbed to things with a new e-mail address, relying on the catch-all to put it all into one box. Big mistake. First off, I got FLOODED with e-mail bounce-back spam because spammers send e-mail with forged From: headers and I'd get all the errors. Second, I discovered that nobody is actually selling my e-mail address except for one gaming forum I used years ago. Not even Face…

> Not even Facebook has sold my e-mail address. Won't FB be among those least likely to sell your email address? FB has tons of ways to make money using your data. Your email address offers very low marginal utility over all the rest of your data.

FYI you've used marginal utility incorrectly in this context. I think it would be better to say a low return.

"thus the marginal utility of a good or service is the change in the utility from an increase in the consumption of that good or service." [1]

[1] - https://en.wikipedia.org/wiki/Marginal_utility

Re: Show HN: NBox – Sign up anywhere without giving your email address

#167

Post by cJ0th »

NicoJuicy wrote: post #102
talove wrote: post #95

I've had a catch-all for *@mydomain.com forward to my primary email address for 10+ years. In that time I signed up for services and websites with [domain]@mydomain.com thinking I'd catch all those dirty scoundrels selling my email address and have an easy way to filter unwanted mail. But you know what really happened? I wound up with hard to remember email logins and caught less than a handful of services sharing my…

lol. I have nico+domainname@domain.com , it's a standard alias used by google apps to forward to nico@domain.com It's worth it and only 1 password

I also use the respective domainname but instead of my given name I generate a short random sequence with pwgen.

Re: Show HN: NBox – Sign up anywhere without giving your email address

#168

Post by ComodoHacker »

kinkrtyavimoodh wrote: post #133
Sohcahtoa82 wrote: post #113

Earlier quoted context omitted.

I did that, too. Used a catch-all and just subbed to things with a new e-mail address, relying on the catch-all to put it all into one box. Big mistake. First off, I got FLOODED with e-mail bounce-back spam because spammers send e-mail with forged From: headers and I'd get all the errors. Second, I discovered that nobody is actually selling my e-mail address except for one gaming forum I used years ago. Not even Face…

> Not even Facebook has sold my e-mail address. Won't FB be among those least likely to sell your email address? FB has tons of ways to make money using your data. Your email address offers very low marginal utility over all the rest of your data.

Facebook would rather BUY users' e-mail addresses in bulk.

Re: Show HN: NBox – Sign up anywhere without giving your email address

#169

Post by ldite »

talove wrote: post #95

I've had a catch-all for *@mydomain.com forward to my primary email address for 10+ years. In that time I signed up for services and websites with [domain]@mydomain.com thinking I'd catch all those dirty scoundrels selling my email address and have an easy way to filter unwanted mail. But you know what really happened? I wound up with hard to remember email logins and caught less than a handful of services sharing my…

Companies/organisations whose data leaks I have discovered through spam to single-use addresses:

  * monster.com
  * linkedin
  * Pragmatic Programmers (pragprog.com)
  * audioscrobbler (now part of last.fm)
  * The London Cycling Campaign
  * The Economist's subscription department

Re: Show HN: NBox – Sign up anywhere without giving your email address

#170

Post by 77pt77 »

talove wrote: post #95

I've had a catch-all for *@mydomain.com forward to my primary email address for 10+ years. In that time I signed up for services and websites with [domain]@mydomain.com thinking I'd catch all those dirty scoundrels selling my email address and have an easy way to filter unwanted mail. But you know what really happened? I wound up with hard to remember email logins and caught less than a handful of services sharing my…

Sub-addressing is an easier way to do that.

If you use a "regular" character like "." as a separator virtually all sites will accept the email as valid vs using something like "+".

Post reply on HN