[deleted]
Tell HN: After 10 years of experiments, custom username emails receive no spam
231–240 of 359 posts
Re: Tell HN: After 10 years of experiments, custom username emails receive no spam
#232I do the same thing. A few of them (Adobe, linkedin) have gotten hacked and spammed to the gills (so I black hole them) them but it’s often rare and I’m realizing it’s not worth the effort to micromanage email aliases in this way.
Re: Tell HN: After 10 years of experiments, custom username emails receive no spam
#233I did that for years, and probably need to do some digging into the "catchall" mailbox they all dump into. I've had a few start receiving spam, which is how I knew when those companies had had some sort of data breach (looking at you, United Airlines, happened at least twice!) even if it was only via a third party marketing firm or the like.
Re: Tell HN: After 10 years of experiments, custom username emails receive no spam
#234I've been doing the same for 20+ years (started in 2001, at the time hosting my own sendmail), so I have used custom email aliases in thousands of sites, from retailers, banks, government websites, and everything else you can possibly imagine. My recent experience has been similar to yours, but it is a more recent development.
In the beginning I used to receive a lot of spam -- sometimes dozens per day. I'd frequently get blasted with dozens of the same spam, to every possible alias they had access to. Sometimes they would use randomized From: addresses or other small customizations to trick spam filters, but frequently not even that.
Also I remember receiving spam on addresses used for companies which had never publicly disclosed they'd been hacked (looking at you, NYC MTA [1]). A few times I tried reaching out to the company to alert them, but it was always met with skepticism, plain denial, or outright passive-aggressiveness (e.g., "_How do you know?_", potentially implying I was involved). Fool's errand.
At some point I moved to Gmail when they started offering Google Apps for Business with custom domains. At the beginning their spam filter was very weak, but it got progressively better.
Over the last 5-6 years, the volume decreased dramatically. At most I get a couple of dozen emails per week (almost all flagged as Spam). I'd imagine the combination of IP filtering, email authentication (DMARC, SPF, DKIM), and ML-based spam filtering got so good that spam isn't profitable for anymore.
I also monitor my domains with Have I Been Pwned [2]. As of today, I have 59 of my aliases in leaked databases -- which is a small fraction of the leaks I've experienced firsthand over the years.
[1] https://twitter.com/GuiAmbros/status/1555358970516328449
Re: Tell HN: After 10 years of experiments, custom username emails receive no spam
#235Well, after doing this for 30+ years, but not actually trying to run any experiments, I have found the opposite. Of the 1670 email aliases that I've created, I've received spam at about 5% of them. Sometimes it happens years after any interaction, possibly from a sale of assets after a shutdown. Sometimes it happens immediately (within a day or two of being created). Sometimes it's from a breach that the other party may not be aware of (yet). Sometimes it's from a dictionary email attack. Just last week I was spammed from South America to an email address I only ever provided to my local police station.
I have no idea what "hot" email addresses sell for on the dark nets, but it's probably something greater than $0, which means the outsourced third-world CRM workers will scrape and sell them whenever possible.
Re: Tell HN: After 10 years of experiments, custom username emails receive no spam
#236Is this not what “+” addresses are for?
Many email providers automatically create a folder with the “plus” name.
For example: youremail+company@yourdomain.com
Creates a folder named “company” and puts those received emails into it.
Re: Tell HN: After 10 years of experiments, custom username emails receive no spam
#237Earlier quoted context omitted.
I've seen sites that disallow auto-generated addresses, super lame and makes me not want to use them, not sure how common that is today.
How do they disallow it?
I'm not sure if this is the same thing, but I think there are published lists of domains used by e.g. mailinator, so if they see a match they just reject you with a "please use a valid email address" message.
Re: Tell HN: After 10 years of experiments, custom username emails receive no spam
#238Another data point - I do the same thing. Out of the 100's I've done it for, about maybe 3 seem to have been compromised.
Re: Tell HN: After 10 years of experiments, custom username emails receive no spam
#239I do the same thing with my email and have actually gotten a few spam mails as a result. I have of course contact said companies and told them about it. None of them seems to be blatant selling of data, though.
However, I am receiving a _bunch_ of spam email to "first.lastname@mydomain.xz". I do have one default inbox everything goes into, if it does not match a filter.
Re: Tell HN: After 10 years of experiments, custom username emails receive no spam
#240Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good? Email databases for sale are not always for spam or malware. They are often used for tracking and cross marketing calculations. Placing a companies name in the address will signal a canary and they may likely filter your contact out of their database or at least flag it and treat it differently. I've been using email…
I have been thinking about using some sort of UUID-generator ([UUID]@mydomain.xz) whenever I sign up for a new site, but I just can not think of a _good_ way to keep track of them.