Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Ode to Apple’s Hide My Email

empty.coffee

Post reply on HN
Print view View original

231–240 of 298 posts

Re: An Ode to Apple’s Hide My Email

#231

Post by toxik »

r2b2 wrote: post #213
jen729w wrote: post #122

Earlier quoted context omitted.

Only if the entity on the other end understands this though, right? Which they probably don’t. Otherwise everyone @example.com is the same person.

It's worth a lot of money for the ad-tech (consumer tracking) industry to understand. If a domain only occurs once in a user database, it's likely to be a personal domain. A data broker that sees the same domain in a few different datasets (once in each) can be quite confident that the domain is an individual's.

They cannot know if it’s a small domain like a business, or a personal catchall. It works fine.

Re: An Ode to Apple’s Hide My Email

#232

Post by rhn_mk1 »

binwiederhier wrote: post #39

I have a unique email address for every single service that I sign up for, similar to this, though selfhosted. I've been doing this for years and it works wonderfully. If someone misuses my email address, or gets annoying, I can simply turn off the address. Bam! It's the easiest Postfix config in the universe, essentially just: virtual_alias_domains = domain1.com domain2.com virtual_alias_maps = hash:/etc/postfix/vir…

Same. Although gmail is not fine with this. If I want to talk to a gmailian, they must send me an email first. Sometimes my reply gets spammed too.

Bonus: a ghetto alias generator:

dd if=/dev/urandom bs=1 count=10 | base64

Re: An Ode to Apple’s Hide My Email

#233

Post by rhn_mk1 »

aendruk wrote: post #193
z8 wrote: post #58

Earlier quoted context omitted.

I'm doing the exact same thing. Built a small web app that lets me manage all my email aliases for the domain. Unfortunately there are a couple of websites that do only allow a select list of whitelisted domains meaning I cannot use my own, but for the other 99% it works wonders. I wish I had had this idea ten years ago, it would have saved me so many headaches.

Who whitelists email domains? Do they explain why?

I think yandex does. Or at least they didn't allow one person send emails to me. "invalid address".

Re: An Ode to Apple’s Hide My Email

#234

Post by nicky0 »

tao_oat wrote: post #230
nicky0 wrote: post #228

Earlier quoted context omitted.

Seems great, but the same question I have with most email add-on services, how do I know you aren't reading my email? Seems a risk to introduce additional 3rd parties into the email system.

I agree that this is a challenge! If you want to use the hosted version, it's impossible to avoid the need for that trust. I'm working on making self-hosting easier for this reason. Some other services (like Firefox Relay) will use AWS' Simple Email Service for everything. I opted to go for [MailPace]( https://mailpace.com/ ), an independent, privacy-focused provider instead, which is an improvement but still not ide…

That's a good answer, appreicated.

Re: An Ode to Apple’s Hide My Email

#235

Post by itsthejb »

beeboop wrote: post #140
rootusrootus wrote: post #68

Earlier quoted context omitted.

I do a simplified version of this. I just use a catchall account with Fastmail and then pick email addresses in the domain randomly. If someone abuses the address, I block it. I specifically do not use addresses that make it obvious what my strategy is. I end up just using a name and number that would look right at home on gmail. I'm also not trying to stop tracking, so much as I'm trying to have my own semi-permanen…

I've been happily using fastmail for years and I think I'm going to be forced to stop. My outbound emails are constantly getting caught in spam and it recently cost me a job offer.

With your own domain? Make sure you’ve got an the SPF, DKIM set up correctly, and register your domain with gmail’s postmaster tools. I moved my domain recently, and had completely forgotten about all that stuff I’d set up years ago. Started losing mails, redid the setup

Re: An Ode to Apple’s Hide My Email

#237

Post by masklinn »

mulmen wrote: post #166
binwiederhier wrote: post #39

I have a unique email address for every single service that I sign up for, similar to this, though selfhosted. I've been doing this for years and it works wonderfully. If someone misuses my email address, or gets annoying, I can simply turn off the address. Bam! It's the easiest Postfix config in the universe, essentially just: virtual_alias_domains = domain1.com domain2.com virtual_alias_maps = hash:/etc/postfix/vir…

I tried to do this but my dentist’s receptionist got confused and cancelled an appointment because “I used their email address”. Square also makes this incredibly difficult because if you enter a merchant specific email they permanently tie it to your card. So now any time I ask for an email receipt I get an email to my hairdrstylist’s “unique” email.

> I tried to do this but my dentist’s receptionist got confused and cancelled an appointment because “I used their email address”.

Never had it go that far but I definitely had some odd reactions e.g. a support agent thinking I was a colleague.

On the other hand, if you have a relatively common name it avoids people giving your email address then behaving aggressively when you tell them to stop. I’ve had a few friends hit this issue.

Re: An Ode to Apple’s Hide My Email

#238

Post by josephg »

gruez wrote: post #190
withinboredom wrote: post #146

Earlier quoted context omitted.

There is nothing secure about email. It's less secure than Telnet. You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually came from the domain. It's literally the easiest thing on earth to spoof. Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect…

>Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets. That's obviously false if you bothered to do a bit of searching: https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#... >You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually c…

> but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all.

You would think so.. but its remarkable how easy it still is to forge email.

My mum was recently the target of such a campaign. She's in the executive team at an international NGO. An attacker found her email address and a bunch of her contacts via the NGO's webpage. Then they forged emails from her email address, with a gmail address set up in the reply-to field. The emails all said it was an emergency, and asked for her colleages to transfer money.

As far as we can tell, most of the emails were delivered and lots of people were fooled - at least for awhile.

Her email address has DKIM and SPF set up, but (like most email providers) it has a lax DMARC policy. It turns out thats all it takes to be vulnerable to this sort of attack.

Re: An Ode to Apple’s Hide My Email

#239

Post by mulmen »

masklinn wrote: post #237
mulmen wrote: post #166

Earlier quoted context omitted.

I tried to do this but my dentist’s receptionist got confused and cancelled an appointment because “I used their email address”. Square also makes this incredibly difficult because if you enter a merchant specific email they permanently tie it to your card. So now any time I ask for an email receipt I get an email to my hairdrstylist’s “unique” email.

> I tried to do this but my dentist’s receptionist got confused and cancelled an appointment because “I used their email address”. Never had it go that far but I definitely had some odd reactions e.g. a support agent thinking I was a colleague. On the other hand, if you have a relatively common name it avoids people giving your email address then behaving aggressively when you tell them to stop. I’ve had a few friend…

> On the other hand, if you have a relatively common name it avoids people giving your email address then behaving aggressively when you tell them to stop. I’ve had a few friends hit this issue.

I’m sorry, I can’t parse this. Can you try again?

I used @. My name was never involved in the address.

Re: An Ode to Apple’s Hide My Email

#240

Post by Vinnl »

3np wrote: post #178
Vinnl wrote: post #91

Earlier quoted context omitted.

Mozilla also has Firefox Relay: https://relay.firefox.com/ (Disclosure: I'm on the Relay team.)

Any thoughts on improving the situation on self-hosting? I've written about the situation for Firefox Accounts (FXA, a dependency of Relay if you don't want to use third-party hosted services) here before[0][1] and Relay looks kind of similar. When comparing Relay with the other two, I get the impression that SimpleLogin/AnonAddy actually interact with the community and understand that self-hosting is something peopl…

I can only speak for myself, but my honest answer would be that indeed, self-hosting probably won't be easy to do any time soon. We're trying to get a less technical audience to benefit from privacy protections too, and I don't think there's a good approach to get them to self-host as well, so focusing our limited time on other things is probably more effective. But who knows, actual use and user research do influence our roadmap, so nothing's set in stone.

But you're absolutely right, the caveat is indeed that the reason you care about open source does matter. If you want to self-host, you're probably better off with another product. If you want to be able to see what code is running, or even be in control of the running code yourself (even if it's running on someone else's servers), then Relay might be interesting too.

Post reply on HN