Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mailhero – a more permanent temporary email

mailhero.io

Post reply on HN
Print view View original

41–50 of 91 posts

Re: Mailhero – a more permanent temporary email

#41

Post by raihansaputra »

kijin wrote: post #8

If this becomes popular, what stops spammers from figuring out that the part before the last dot in the username can be anything? A lot of shady folks already know about Gmail's plus-addressing trick. If I were a spammer and I found that foobar.username@mailhero.io didn't work, I would just try bazbaz.username@mailhero.io. Perhaps you could set up the system to only accept aliases that have been explicitly configured…

i think an easy way is to send a notification email for every new sub-email "registered". No email gets forwarded until the new sub-email is verified.

Re: Mailhero – a more permanent temporary email

#43

Post by wiradikusuma »

Since I have Google Apps (eg bla.com), I just turn on "catch-all email" settings, and whenever I join a service, I'll use "servicename@bla.com" (eg paypal@bla.com).

Interestingly, sometimes I receive spam from AnotherService sent to OriginalService@bla.com. From there you can see which services sell their data to 3rd party.

Re: Mailhero – a more permanent temporary email

#44

Post by lewisl9029 »

kilburn wrote: post #39
lewisl9029 wrote: post #34

Earlier quoted context omitted.

I've been doing something similar, except with a Google Apps catch-all address. Unfortunately, a lot of spammers use BCC, so AFAIK for those emails there's no way to figure out which email address was compromised, and thus no easy way to filter them out en masse.

The easiest way is to filter based on the "Delivered-To" header (click on "view original" to see all headers). No amount of BCC'ing affects that header because it is set by gmail itself, not by the emitter.

Wow. This is amazing.

Time to go back and look through all my spam and filter them all. =)

I only wish I kept more of them around...

Re: Mailhero – a more permanent temporary email

#45

Post by jbergstroem »

schneems wrote: post #15

I made something almost exactly like this 6 years ago. Called whyspam.me Good luck.

This here is unfortunately why services like these are a bad idea. If you don't control the MX pointer you need to accept that these mails can be lost. A lot of mail providers seems to support the + syntax and similarly so MTA's like postfix. I would suggest you direct your attention there instead.

Re: Mailhero – a more permanent temporary email

#46

Post by gdiepen »

I have been running a similar service for myself on my own exim mailserver for a couple of years now and very happy with it. Provided explanation on how to achieve this on my blog https://www.guidodiepen.nl/2013/02/catch-almost-all-in-exim-... Whenever an address is receiving too much spam, I just blacklist it at the server level, ensuring I don't have to filter it anymore in my mail client since the server won't even accept it.

Have to say that it is always funny when a person asks for my email address and it confuses them when the address part before the @ sign contains their company name :) Often get the question whether I also work at the company or so.

Re: Mailhero – a more permanent temporary email

#48

Post by trickster_ »

gdiepen wrote: post #46

I have been running a similar service for myself on my own exim mailserver for a couple of years now and very happy with it. Provided explanation on how to achieve this on my blog https://www.guidodiepen.nl/2013/02/catch-almost-all-in-exim-... Whenever an address is receiving too much spam, I just blacklist it at the server level, ensuring I don't have to filter it anymore in my mail client since the server won't eve…

That was a nice tutorial! I did something similar too before creating Mailhero.

And regarding the confusion about stuff before the @-sign: I have gotten "Wow, you work here?!" a million times too... :)

Re: Mailhero – a more permanent temporary email

#49

Post by cuu508 »

findjashua wrote: post #28

With gmail, you can create a custom email for each service, like so: youremail+service@gmail.com Later on, if the service doesn't let you unsubscribe, or sells your email to other spammers, you can just set a filter to trash emails sent to youremail+service@gmail.com

With gmail, my process with unwanted emails is:

1) Locate and click the "Unsubscribe" link. Usually, that is it.

2) If there is no "Unsubscribe" link, or if it requires more than one subsequent click, then "Report Spam"

3) ... if I get an email after unsubscribing, "Report Spam" straight away

Re: Mailhero – a more permanent temporary email

#50

Post by Jaruzel »

Like many of you, I've rolled my own interpretation of this solution. I've got a self-written MTA that supports any recipient prefixes on emails that are sent to @domain.com. It then firstly checks the RCPT TO: address (the _real_ TO address) against the email aliases assigned to all my users in the Active Directory/Exchange Server. Once that check is passed, it then runs the email through some custom blacklisting rules, and then finally runs the email through SpamAssassin. If the email gets past that, then it gets delivered into the users inbox.

In Active Directory, the proxyAddresses attribute is used to stack up custom @domain.com addresses for each user, which allows for many aliases per inbox. It does require management on the users part - they have to add an alias if want to use it, but that's done via a webform, so easy to do. Likewise they can yank an alias if it's been leaked and gets abused.

This solution has been running for over 5 years now, and it works very very well. The only downside is having to manually add new custom blacklist rules due to the adaptive nature of the spammers.

Post reply on HN