Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: GitHub now blocks aliased email addresses

news.ycombinator.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Tell HN: GitHub now blocks aliased email addresses

#41

Post by iliketrains »

function_seven wrote: post #23
iliketrains wrote: post #11

Earlier quoted context omitted.

I do the same as KMnO4 and I think I have never received an email to a random address that I haven't shared before. Currently the biggest volume of spam is coming to adobe@ and github@ (along with some dating sites). Actually, I did receive one, from my friend who typed the entire message in the name before the @ and left the body and subject empty :D

> Actually, I did receive one, from my friend who typed the entire message in the name before the @ and left the body and subject empty :D So something like this? From: bobby@tables.com To: myplanejustlandedcanyoucomepickmeup.thx@lastname.com Subject: Body:

Exactly! The message was like 3x longer, I wonder what is the limit?

Re: Tell HN: GitHub now blocks aliased email addresses

#42

Post by nobody9999 »

cgb223 wrote: post #21
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

Do you have to set up a new email address for each website you sign up for or do you have software that automatically handles it? Sounds tedious if it’s the former

>Sounds tedious if it’s the former

Thankfully it isn't.

To set a catchall with sendmail, add a line to /etc/mail/virtusertable like so:

   @domain.tld
And if I decide to block a particular address, which I've only had to do with addresses set up for specific sites (which I've then decided sends me too many emails -- I've yet to receive spam that's not from the site in question), add a line to /etc/mail/access like so:

   To:@domain.tld error:5.1.1:"550 User unknown"
And that can be temporarily (or permanently) reversed by commenting it out. I imagine it's something similar for postfix, qmail, exim, etc.

Edit: I'd add that I make extensive use of folders/filters to handle email as well, so unless I don't want to use a site/service any more, I'll usually create a filter unless I don't want any more contact with a specific entity -- then it's "user unknown" for that email address.

Re: Tell HN: GitHub now blocks aliased email addresses

#43

Post by teawrecks »

takoid wrote: post #4
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

My understanding of how email works is: for each email sent, there's a sending and receiving server that exchange a message between users on each.

* If a server tries to send an email to a user that doesn't exist on another server, the email will "bounce", and the receiver will automatically respond with an error (we've all seen this).

* If a server slowly spams another server with emails to invalid users (say once an hour) they'll just get bounced back each time. No harm done.

* If a server spams another server with an onslaught of emails, even if they are to a valid user, at some point it becomes a DOS attack and the IP of that server will be blacklisted.

So the case you're probably concerned about is the second one where they could essentially brute force a username slowly enough that they don't trigger any red flags. But the time investment, compute power, and bandwidth necessary to do that is not worth how easy it would be to mitigate that. "Great you figured out my email address. Blocked."

If they're going to spend time shooting into the dark like that they might as well be guessing random passwords to public facing ssh servers (which bots are doing all the time).

Re: Tell HN: GitHub now blocks aliased email addresses

#44

Post by GeekFortyTwo »

takoid wrote: post #4
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

I do similar and never see that occur.

What I do get are a lot of misdirected messages for people at a school district(one letter, that sounds the same, off from mine) and a defunct tech school in India.

The amount of personal information that companies will send to an unverified email address is terrifying. Devs, please make sure you send a confirmation email before believing an address is good. If I was malicious I could really mess with a lot of travel plans for people, among many other things.

Re: Tell HN: GitHub now blocks aliased email addresses

#45

Post by joshka »

hk1337 wrote: post #15
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

yeah, I started using Fastmail's masked email to create emails for services that route to my inbox. Initially I did it with my email domain then figured because my email domain has my name in it that it seemed semi-pointless so I switched to just using Fastmail's domain.

I think there's a subtle extra step there. Create a new domain that just exists to handle masked emails and only masked emails. (I'm in the process of doing this).

Re: Tell HN: GitHub now blocks aliased email addresses

#46

Post by nieve »

KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

I did this and heartily endorsed it up until the day I got 1.4 million spams in under 24 hours.
Post reply on HN