Live data from Hacker News

Tell HN: After 10 years of experiments, custom username emails receive no spam

news.ycombinator.com

191–200 of 359 posts

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#191

This is not my experience, I too have been doing this for 10 years. In my experience, I got tons of spam, especially after a leak. By far, the _most_ spam I get to is get to government agencies and medical facilities. I started getting male enhancement messages to my parknyc (NYC parking meters) address in under a week after registering. Since my addresses are never used for more than one service, I can be reasonable…

I've had CCs stolen because DMV + FasTrak required CC info and can't use PayPal. PayPal / Shop are great because they don't share your actual CC info with the merchant, only a one-time token for that specific transaction. All credit cards should work this way, where you'd log into your bank or 2FA with your bank (or Visa / MasterCard) and they'd provide the merchant with an auth code or something just for that transa…

All European credit and debit cards have a 2FA enabled. You cannot pay online without authorization from (bank) app.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#194
Catch-alls are fun. Sometimes when I delete and purge an account somewhere (digitalocean for example, the checkbox is literally called 'purge'), all they do is change the user part of the email address:

me@example.org -> _me@example.org. "Yup now the account is deleted, we hope to see you again soon!"

It's too bad the GDPR authority in the Netherlands is much too swamped to care about a literal purge option doing literally nothing. In both instances, I was still able to login to the account with the original password (clearly not information necessary for tax record reasons, or whatever excuse they might come up with). I don't always check the developer console for the API response that might hint at this, and don't delete accounts that often to begin with, so it wouldn't even surprise me if a majority of services turned out to do something similar under the hood.

Screenshot: https://snipboard.io/Y2MpbU.jpg (DigitalOcean's account deletion page, this is the option I checked but was still able to log in. The other offender, I don't want to even give the benefit of free negative publicity.)

---

Catch-alls are fun. Sometimes when I email a company, like Contoso@mydomain.example.org, I will subsequently receive business email from their vendor (helpdesk or IT or whatever service they provide that made my email end up in the autocomplete) that was intended for their contact person at Contoso. I've always let them know but it feels rather awkward and they never reply to me :)

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#195

I use fastmail and I have created many aliases. Some in order to avoid spam, others to help organize my inbox. One of my aliases was clearly compromised and it is now sent a lot of spam. Do I simply delete the alias and retire it and update my email with whatever services I care to hear from? As an aside, I have found the spam filter on Fastmail to be pretty bad. Anyone else have this experience?

As an aside, I have found the spam filter on Fastmail to be pretty bad. Anyone else have this experience? Same. I love Fastmail, but even after almost a decade of training, spam filtering is quite bad compared to eg. Google Mail.

I have Fastmail fetch email from my Gmail inbox. Spam that clears Gmail's filter and lands in my inbox, that Fastmail then retreives, ends up in my Fastmail spam folder.

Fastmail catches what Gmail does not in my case. Though the reverse has not been tested.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#196

Earlier quoted context omitted.

Wouldn’t it trivial for them to strip out all values from + to @ prior to selling your address?

Yes. I've written code that does this for parsing leaked email lists before as part of a normalizing step.

Not sure why this is downvoted. I can imagine non-nefarious reasons to collect these lists.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#197
Are people really inconvenienced by email spam anymore? My email is posted publicly all over the internet, it's been used to make hundreds of accounts for various other companies, it's been in innumerable data breaches, and I haven't changed addresses since GMail launched in 2004. In a bad week I might get two spam messages in my inbox. Each one is dealt with in probably around three seconds. On average I get less, probably around one per month.

I really enjoy that the spam filter catches borderline messages like promotional newsletters from companies I do business with that I didn't intend to sign up for. And I can count on one hand the number of times since 2004 that an email that actually mattered was sent to my spam folder by mistake.

Every form of communication I use has spam and most are much worse than email. I get SMS spam, phone call spam, snail mail spam, WhatsApp spam, phone notification spam. In most cases the spam is harder to deal with and a larger percentage of the total. Phone call spam and snail mail spam in particular are way above 50% for me. Even after doing all the marketing opt-outs I can find.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#198
I've done this as well for over two decades, but with no spam filter besides mailavenger/greylisting for a time.

I've gotten spam to places that have had their databases leaked and widely reported. Off the top of my head, Zynga and Consumerist.

I've also gotten spam from individual eBay vendors (etc), to my ebay@ and paypal@ address. But there's no way to particularly stop that, beyond knowing that ebay and paypal leak my email address.

I get a lot of spam to an admin@ address on a domain I bought that was evidently in use previously.

I also get spam from companies I used quite a while ago, and were either acquired and renamed, or are still in business. I haven't purchased or even signed into the website of "PCB Fab Express" in over 15 years, but they still see fit to email me.

In general I don't find it that much of a hassle to hit 'd' on spam, hence not particularly caring about a spam filter, or not setting up a procmail recipe that bounces the spammy businesses.

FWIW I actually don't get much spam any more to the first category of email leaks. I'm sure it goes in waves with whatever lists are in vogue.

I still do find the custom email addresses nice for creating a small impediment to cross-referencing surveillance data, and don't see any reason to stop them. If the saying "YourCompany@" to a Your Company rep was really that awkward, I'd switch to opaque shorter handles, but it hasn't been a problem. Sometimes I'll just own it and say I do this so I know when companies sell my email address to spammers.

Also, I read my email with mutt in a terminal, possibly passing it through lynx when I need to. If my client loaded image bugs or other html nonsense, my experience might be much different.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#199
post #186

Earlier quoted context omitted.

I had a funny interaction with a financial institution about this at one point. They were having a lot of trouble understanding that company@mydomain.com was the correct email address. Eventually the conversation went like: "So you're saying you created a new email address just to use with us?" "Sure, yeah." "...That's weird."

The weirdest of these i had were support agents who thought I was a colleague because I usually use @

I did that for one of my amazon accounts a few years back when i registered at an amazon conference (probably aws reinvent)- i.e. amazon@mydomain.com - and for about 6 months I got onto some internal email list at amazon/aws, definitely not intended for the public, likely because someone queried for all email address that had 'amazon' in the address from this registration list - thought it was pretty funny, but eventually they stopped - someone probably figured out what they did wrong.

Also have one for thifty@mydomain.com (the car rental company) - when they saw my email address at the counter they gave me the employee discount rate - I didn't correct them :)

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#200
post #80

I'm glad you had a good experience. I had a different one. I've ran my own domain for longer than you have, and many emails have been compromised. Some are 100% from companies selling the emails to sister companies. The majority, though, is from a company itself being compromised by hackers / database access / etc. LinkedIn, Neopets, ProFlowers, TeeSpring, etc. I can go on.

Seconding this. And to compound this after doing a half ass job of what OP has done, I recently moved my custom google apps free domain to have a second reception domain i use JUST for this with a `.email` TLD (side note: the amount of tools that don't see modern TLD's as valid is enraging)> I made the (maybe poor) choice of donating to political campaigns before the last US election using these emails - `Biden-campa…

Yeah, HoN was the first of my catch-alls to receive spam. Idiots didn't even acknowledge that they have been compromised and insisted that obviously I did use hon@mail.mydomain.tld somewhere else. These days I'd use the opportunity to check how well GDPR works in practice.
Post reply on HN