Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everyone Wants Your Email Address. Think Twice Before Sharing It

nytimes.com

Post reply on HN
Print view View original

71–76 of 76 posts

Re: Everyone Wants Your Email Address. Think Twice Before Sharing It

#71

Post by crtasm »

crossroadsguy wrote: post #12
legitster wrote: post #4

An easier way to spin up emails for every account: For some email providers, if you add a "+" modifier to your email address, anything after the + will be ignored and still routed to your main email address. But email systems will still treat them as unique email addresses. (So abc123+Netflix@gmail.com and abc123+nytimes@gmail.com would both be delivered to abc123@gmail.com. This limits their ability to link your acc…

I tried this. Tried this with my domain as well. Spammers have figured this out. They start spamming random emails on my domain and since there's catch all I do receive them. Randomly generated emails from dedicated services (duck.com, HME etc) work better. I can just disable them and don't have to worry about other random emails. Handling all this on my own domain is going to cost me a lot in both money and time and…

Maybe that was targeted, I don't get random address spam on my 15yr+ catchall.

I do get a lot of spam sent to [someone else's email] where my own email address was BCC'd.

Re: Everyone Wants Your Email Address. Think Twice Before Sharing It

#72

Post by cheerylion »

frereubu wrote: post #50
333ads wrote: post #18

I've found fastmail's masked email to be a great solution to this. I don't give any services my primary address these days.

I tried this, but the thing I didn't like about it was that it ties you into Fastmail. I like using a custom domain so it's relatively easy to change your email provider, but masked emails are in the format xxx.xxx@fastmail.com so you'd need to revisit all of those accounts if you want to change your email provider to someone else. I'm currently trying using a catch-all with servicename@mydomain.com, and will be inte…

You can set the Masked Email function to use a custom domain:

https://www.fastmail.help/hc/en-us/articles/4406536368911-Ma...

I do this with a generic-sounding domain (...mail.tld), and I purposefully don't have catch-all enabled for this domain. That way, when I disable a masked address I completely block the service I used it for from sending me emails.

To further reduce ties to Fastmail, I believe you can export a list of all your e-mail addresses used.

Re: Everyone Wants Your Email Address. Think Twice Before Sharing It

#73

Post by Towaway69 »

wirelesspotat wrote: post #55
armada651 wrote: post #38

Earlier quoted context omitted.

I've been thinking of running a setup like this specifically to rat out who's been selling my e-mail addresses, since the spam would be directed at the service@service.mydomain.com. Did you find any interesting results from your setup? Some surprising services who sold your address?

Not GP but I have the same set up and have only had a couple times where I received unexpected emails to an inbox. One was from GitHub profile scraping, can't remember what the other one was. One of the surprisingly useful areas is with deliveries. Emails from delivery companies (especially from abroad) often don't specify what it is they're delivering or who it's from. But with this set up I can easily check that wi…

Can confirm, I'm using the same fastmail setup, same strategy using service@... and no complaints and no spam.

I also use catch-all and no noticeable increase in spam.

Re: Everyone Wants Your Email Address. Think Twice Before Sharing It

#75

Post by dogman144 »

hnbear wrote: post #46
dogman144 wrote: post #30

Earlier quoted context omitted.

Is your intent privacy? I've thought through similar setups, but if the intent is to break cross-platform correlation to a user/device ID and related de-anonymization, I keep coming back to these questions: - How do I know fastmail doesn't sell data? If every one-time domain is tied to a static fastmail account, and the fastmail account has my real info and sells it, then the obfuscation per-service is moot. - Google…

I owned and ran my own email domain for a long time. Initially on my own hardware for fun, then a VPS, then GSuite, then Fastmail. That's over around 20 years. So, it wasn't planned - it evolved. Somewhere in the Fastmail era I was reading their docs around wildcarding and thought I'd try it out. My primary domain is my name though, so for extra privacy (anality) I bought another that has no link to me in the name. T…

Makes sense, seems like this setup still has the same issues I brought up, but good to know others are sorting through the same issue.

I spent a good while reading about adtech from the practitioner side (i.e. adtech devs) vs. from the privacy side, and it was illuminating. Basically, the fears of privacy advocates get laid out in plain "this is a great feature for user correlation" speak, without any of the feature-masking used when adtech discusses it in privacy terms with privacy-conscious audiences.

In short, my takeaway from that research was it only takes 1x merchant or infra provider which can correlate a "masked" domain/VOIP number/PO box with something IRL of yours to basically undo the whole privacy effort. Without ironclad knowledge the vendor doesn't sell data (which is hard to get), it's as good as safely assuming the data got sold (or the pixel in the webpage did it, and so on).

Tough to think through! I think LLC'ing ones life, if in the US, is the only way to truly do it or get a reasonably high guarantee. You'd get corporate privacy guarantees which are unfortunately stronger than individual privacy guarantees in the states.

Re: Everyone Wants Your Email Address. Think Twice Before Sharing It

#76

Post by frereubu »

cheerylion wrote: post #72
frereubu wrote: post #50

Earlier quoted context omitted.

I tried this, but the thing I didn't like about it was that it ties you into Fastmail. I like using a custom domain so it's relatively easy to change your email provider, but masked emails are in the format xxx.xxx@fastmail.com so you'd need to revisit all of those accounts if you want to change your email provider to someone else. I'm currently trying using a catch-all with servicename@mydomain.com, and will be inte…

You can set the Masked Email function to use a custom domain: https://www.fastmail.help/hc/en-us/articles/4406536368911-Ma... I do this with a generic-sounding domain (...mail.tld), and I purposefully don't have catch-all enabled for this domain. That way, when I disable a masked address I completely block the service I used it for from sending me emails. To further reduce ties to Fastmail, I believe you can export a…

Oh, thanks! I'll take a look at that.
Post reply on HN