Tell HN: GitHub now blocks aliased email addresses

#1

Post by coldblues » Fri, Jan 27, 2023, 7:17 PM UTC

"Our spam detecting systems flagged your account because of the email address you used to register the account. Temporary/aliased email addresses are not permitted for use on GitHub accounts."

"Before we can remove the flag we need you to add a personal, non-disposable email address and then verify that address. You also need to remove the temporary/aliased email from the account."

Bad news for SimpleLogin and AnonAddy users.

Re: Tell HN: GitHub now blocks aliased email addresses

#2

Post by KMnO4 » Fri, Jan 27, 2023, 7:33 PM UTC

I use an email catch all for everything.

github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com.

I rarely get spam these days, but when I do, I simply block the address and move on.

Re: Tell HN: GitHub now blocks aliased email addresses

#3

Post by ackatz » Fri, Jan 27, 2023, 7:33 PM UTC

Is this to deter people from using GitHub Actions runners for bad things?

Re: Tell HN: GitHub now blocks aliased email addresses

#4

Post by takoid » Fri, Jan 27, 2023, 7:40 PM UTC

KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example:

random1@lastname.com

random2@lastname.com

random3@lastname.com

Do you have a whitelist as well?

Re: Tell HN: GitHub now blocks aliased email addresses

#5

Post by sigstoat » Fri, Jan 27, 2023, 7:44 PM UTC

takoid wrote: post #4

KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

in my experience that sort of "send some spam to addresses we have no reason to believe exist" behavior takes the form of sending stuff to $commonfirstname@domain not $service@domain

nobody is sending email to alsdkjfadf@domain

Re: Tell HN: GitHub now blocks aliased email addresses

#6

Post by leipert » Fri, Jan 27, 2023, 7:45 PM UTC

takoid wrote: post #4

KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

Simply doesn't happen. Spammers seem to rely on "real" email addresses which they get from leaks and such.

Re: Tell HN: GitHub now blocks aliased email addresses

#7

Post by takoid » Fri, Jan 27, 2023, 7:46 PM UTC

sigstoat wrote: post #5

takoid wrote: post #4

Earlier quoted context omitted.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

in my experience that sort of "send some spam to addresses we have no reason to believe exist" behavior takes the form of sending stuff to $commonfirstname@domain not $service@domain nobody is sending email to alsdkjfadf@domain

You are right. But I think using a catch all with a separate username for each service/business is becoming an increasingly common practice so I would imagine it’s only a matter of time before spammers catch on and begin exploiting this.

Re: Tell HN: GitHub now blocks aliased email addresses

#8

Post by dijit » Fri, Jan 27, 2023, 7:47 PM UTC

If you run your own mail server, any symbol can be used as an identifier.

Gmail has "+", but I've used '.' for a very long time.

example.hn@mypersonalsite.com

For most sites, things like this are enough to fool. Alternatively I use a base64 encoded version of the sitename.

so: example.aG4g@mypersonalsite.com

Re: Tell HN: GitHub now blocks aliased email addresses

#9

Post by neogodless » Fri, Jan 27, 2023, 7:49 PM UTC

takoid wrote: post #4

KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

I've seen this. Comes in waves - maybe 100s of emails over a few days. Then years of nothing. They get caught by spam filters pretty easily. I do whitelist a few email addresses, filter others into folders. And every once in a while, I have to empty out my spam folder. Not a big deal to me, and still think it's worth using catch-all email and unique email addresses all over the internet.

Re: Tell HN: GitHub now blocks aliased email addresses

#10

Post by jasonjayr » Fri, Jan 27, 2023, 7:50 PM UTC

takoid wrote: post #4

KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

Using random emails like that is a super easy way of getting caught up in a spam trap, which would get you blocked easily.

One of our users used a throwaway a@apple.com, which earned us a complaint inside of an hour, just by sending a welcome/confirm message.