Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Ode to Apple’s Hide My Email

empty.coffee

Post reply on HN
Print view View original

161–170 of 298 posts

Re: An Ode to Apple’s Hide My Email

#161

Post by Tagbert »

Gigachad wrote: post #130
criddell wrote: post #87

Earlier quoted context omitted.

I think Google also has recovery keys. I have a slip of paper with ten long strings on them that Google told me could be used to regain access to my account.

Google seems to have changed their MFA stragagry recently where normal TOTP apps are a backup measure while the already signed in device is the primary. It wouldn't shock me if they don't prompt you to set up the app or recovery keys anymore.

I don’t think that they do [prompt you] anymore. I recently had to setup gmail with google Authenticator and there was no mention of recovery keys. Not sure if I could go in after the fact and generate any.

Re: An Ode to Apple’s Hide My Email

#163

Post by mlapida »

pensatoio wrote: post #100

Hide My Email is an awesome product, no doubt, but why the mention of Have I Been Pwned? Security through obscurity is not worth two cents. Use a password manager and generate your passwords.

My thought process was if you search your primary email, you'll quickly see all the breaches with that email. Using a different email per service reduces the surface area (lateral movement). Security through obscurity has nominal value, but the reduction in ability to correlate has a much higher value.

Re: An Ode to Apple’s Hide My Email

#164

Post by cubesnooper »

PascLeRasc wrote: post #150
sewsuiuldot wrote: post #141

Earlier quoted context omitted.

I wish they'd let users decide what they want to use as additional factors. I would like to ban phone calls, emails, SMS, and TOTP entirely from all my accounts, especially those that hold credentials for other services, and use only WebAuthn. I'd love to use Apple's keychain for credentials for convenience but it can quickly become the weakest link, when it should be the strongest.

What’s wrong with TOTP? Isn’t it exactly as secure as WebAuthN?

TOTP is not as secure as WebAuthn, because if you enter the TOTP code into a phishing site, the phisher can now successfully authenticate as you. WebAuthn was specifically designed to be immune to this case: if you were to use your WebAuthn key in a phishing website, the phisher would not then be able to authenticate as you on the real site.

Re: An Ode to Apple’s Hide My Email

#165

Post by criddell »

Tagbert wrote: post #161
Gigachad wrote: post #130

Earlier quoted context omitted.

Google seems to have changed their MFA stragagry recently where normal TOTP apps are a backup measure while the already signed in device is the primary. It wouldn't shock me if they don't prompt you to set up the app or recovery keys anymore.

I don’t think that they do [prompt you] anymore. I recently had to setup gmail with google Authenticator and there was no mention of recovery keys. Not sure if I could go in after the fact and generate any.

https://support.google.com/accounts/answer/1187538

It looks like they still have recovery codes. I think it’s a good idea to have a set stored in a safe place.

Re: An Ode to Apple’s Hide My Email

#166

Post by mulmen »

binwiederhier wrote: post #39

I have a unique email address for every single service that I sign up for, similar to this, though selfhosted. I've been doing this for years and it works wonderfully. If someone misuses my email address, or gets annoying, I can simply turn off the address. Bam! It's the easiest Postfix config in the universe, essentially just: virtual_alias_domains = domain1.com domain2.com virtual_alias_maps = hash:/etc/postfix/vir…

I tried to do this but my dentist’s receptionist got confused and cancelled an appointment because “I used their email address”.

Square also makes this incredibly difficult because if you enter a merchant specific email they permanently tie it to your card. So now any time I ask for an email receipt I get an email to my hairdrstylist’s “unique” email.

Re: An Ode to Apple’s Hide My Email

#167

Post by treesknees »

FabHK wrote: post #124

A useful feature the article doesn't mention: In macOS Mail and iOS Mail, when you reply to an email or send a new one, you can choose the "From" address: The options are the usual accounts you have set up, plus, now, a "Hide my Email" proxy generated on-the-fly. I've found it very handy on several occasions.

Great, I didn’t realize this was an option. It feels less useful for replies but new emails I could definitely see myself using this.

Re: An Ode to Apple’s Hide My Email

#168

Post by treesknees »

DIVx0 wrote: post #10

I don't use Safari but I still use this feature a lot even though I have to do a few extra steps because it does not integrate with anything other than Safari, its that useful for me. Some sites have never worked properly with the email+tag@gmail.com thing and some have even become wise to it and wont accept addresses like that (car dealers are the worst). I hope someday apple allows 3rd party integration with this f…

Agreed. You can get to it through Settings > Apple ID > iCloud > Hide My Email, but it’s a pain to navigate.

I tend to use it when signing up for something IRL that wants an email address. I wish there was a way to use Shortcuts to generate a new email in one tap.

I’ve been keeping an eye out for a settings URI that will take you there directly https://github.com/FifiTheBulldog/ios-settings-urls/issues/1...

Re: An Ode to Apple’s Hide My Email

#169

Post by mushyhammer »

IAmEveryone wrote: post #134
b1n wrote: post #81

Earlier quoted context omitted.

I've been thinking of a new way to use my email... - Only use one email address: hi@example.com - Always add a filter: hi+hn@example.com - Send all emails without a filter to SPAM Since it's not a common strategy, it is much more likely that spammers remove the +hn before sending an email than add one.

Gmail also ignores the dot. If you choose a 17-character mailbox name, you can use any one of 2^16 different patterns of placing dots between them. Capitalisation could also be used for such a purpose, but may be more likeely to accidentally get stripped.

Dots are useful to create new accounts on the same site, but you can’t use it to just tell websites apart (because there’s no label)

Re: An Ode to Apple’s Hide My Email

#170

Post by binwiederhier »

PascLeRasc wrote: post #148
binwiederhier wrote: post #39

I have a unique email address for every single service that I sign up for, similar to this, though selfhosted. I've been doing this for years and it works wonderfully. If someone misuses my email address, or gets annoying, I can simply turn off the address. Bam! It's the easiest Postfix config in the universe, essentially just: virtual_alias_domains = domain1.com domain2.com virtual_alias_maps = hash:/etc/postfix/vir…

Is Phil a pseudonym first name as well? That’s a smart new technique if so.

Hehe, it seems I'm not that smart. It's my actualy name :-D
Post reply on HN