Live data from Hacker News

An Ode to Apple’s Hide My Email

empty.coffee

241–250 of 298 posts

Re: An Ode to Apple’s Hide My Email

#241
post #131
post #96

Earlier quoted context omitted.

If relay gets popular, won’t some services simply start to block relay subdomain for registration to make it ineffective? Just like 10minutesemail etc are blocked in many places.

You can flag them to the Relay team and AFAIK they'll reach out to the domain that blacklisted them with the hope to make them change their mind. A service that doesn't accept an email proxy during registration is not going to respect my privacy, so IMO not worth of using.

For an example of that, see here: https://github.com/wesbos/burner-email-providers/pull/339

But yes, definitely a concern that is constantly on our radar.

Re: An Ode to Apple’s Hide My Email

#242
post #91

Earlier quoted context omitted.

Mozilla also has Firefox Relay: https://relay.firefox.com/ (Disclosure: I'm on the Relay team.)

I use mozmail and on the fly emails are great but so easy to exploit and spam. For example, my custom domain is foo.mozmail.com. I enter my on the fly email address bar@foo.mozmail.com on attackers website. Voila. Now they know my custom domain name "foo" and can use it to send email to all possible on the fly addresses. e.g. 1@foo.mozmail.com 2@foo.mozmail.com so on and so forth. Now my custom domain name as a whole…

Yes, it is recommended to use a completely random email by default, and only use your custom domain as a fallback when you can't use the random one (e.g. when you have to give up your email somewhere in-person). We're looking into ways to make that clearer, because people's intuition tells them to use their custom subdomains by default.

Re: An Ode to Apple’s Hide My Email

#243

A bit of a plug, but I have written a small piece with some suggestions for services that could be used to hide and not share your main account as well as some pros and cons to them here - https://psyonik.tech/posts/keep-your-email-private/ TL;DR - Cloudflare email works great if you have your domain on Cloudflare, Firefox Relay is cheap and will work with emails up to 150KB and a number of email providers give you t…

Firefox Relay now works with emails up to 10MB: https://blog.mozilla.org/en/mozilla/latest-firefox-relay-inc...

(Disclosure: Relay engineer.)

Re: An Ode to Apple’s Hide My Email

#244
post #58

Earlier quoted context omitted.

I'm doing the exact same thing. Built a small web app that lets me manage all my email aliases for the domain. Unfortunately there are a couple of websites that do only allow a select list of whitelisted domains meaning I cannot use my own, but for the other 99% it works wonders. I wish I had had this idea ten years ago, it would have saved me so many headaches.

Is your app available?

Not as of right now, but I could put it on GitHub. It's essentially just a front end for the Gandi.net email management API. Manually editing the alias list gets cumbersome really quickly.

Re: An Ode to Apple’s Hide My Email

#245

Earlier quoted context omitted.

I do a simplified version of this. I just use a catchall account with Fastmail and then pick email addresses in the domain randomly. If someone abuses the address, I block it. I specifically do not use addresses that make it obvious what my strategy is. I end up just using a name and number that would look right at home on gmail. I'm also not trying to stop tracking, so much as I'm trying to have my own semi-permanen…

I've been happily using fastmail for years and I think I'm going to be forced to stop. My outbound emails are constantly getting caught in spam and it recently cost me a job offer.

One event that pissed me off with them: Instead of forwarding an email to SPAM, they simply throw it away instead. Turns out the email was not SPAM (2FA) and I had to go through weeks of support to find out what happened (thank god that you get a human for support but still).

Also I think they are still based in Australia? Would be happy to hear about alternatives.

Re: An Ode to Apple’s Hide My Email

#246
post #81

Earlier quoted context omitted.

I've been thinking of a new way to use my email... - Only use one email address: hi@example.com - Always add a filter: hi+hn@example.com - Send all emails without a filter to SPAM Since it's not a common strategy, it is much more likely that spammers remove the +hn before sending an email than add one.

I have tried this approach. Unfortunately, some services will not accept plus sign in the username no matter what RFC says. On top of that, some services seem to not like seeing the service name in the username. I.e. foo.tld will refuse sending email to mailbox+foo@mydomain.tld.

Shopify also flags orders (even if they are fully paid) when the customer's email contains the shop's name. I'm sure their logic is that it helps cut down on fraud.

I prefer the system of using a basic abbreviation in the email address to avoid these types of filters but still make the email easily traceable later. Say your name is joe smith and you're buying from Sports Online. Something like Joe_spo_smith@yourdomain.com works well for later confirming whom you gave the address to.

I like this approach because one doesn't have to track all of the catch-all emails made on the fly, since finding out who you originally gave that email to is just a matter of searching your past email and noticing that "spo" looks more like those old Sports Online emails and not the new spam from discounted wholesale fancy rugs.

Apart from seeing who a company has on-sold your information to (or more rarely had a staff member steal their database), it's also an easy way to see who has been hacked.

One other reason not to use something like SportsOnline@yourdomain.com is that some websites exist merely as credential honeypots and those types are usually aware of this approach and will then typically exploit the catch-all for spamming. The shady All on MP3 service was known for doing this. (I'm pretty sure that site existed solely to exploit the fact that most people used the same password for everthing.)

Re: An Ode to Apple’s Hide My Email

#247

Earlier quoted context omitted.

I've been happily using fastmail for years and I think I'm going to be forced to stop. My outbound emails are constantly getting caught in spam and it recently cost me a job offer.

With your own domain? Make sure you’ve got an the SPF, DKIM set up correctly, and register your domain with gmail’s postmaster tools. I moved my domain recently, and had completely forgotten about all that stuff I’d set up years ago. Started losing mails, redid the setup

Any references about spf, dkim, Gmail postmaster ?

Re: An Ode to Apple’s Hide My Email

#248
Another advantage not mentioned is that '@icloud.com' is a generic domain that has been (and still is) used for a lot of real e-mail addresses for years. That means that most registration forms cannot just simply block '@icloud.com' because that would lock out a lot of real '@icloud.com' addresses.

Hide My Email is very good and I'm using it a lot.

Re: An Ode to Apple’s Hide My Email

#249
post #243

A bit of a plug, but I have written a small piece with some suggestions for services that could be used to hide and not share your main account as well as some pros and cons to them here - https://psyonik.tech/posts/keep-your-email-private/ TL;DR - Cloudflare email works great if you have your domain on Cloudflare, Firefox Relay is cheap and will work with emails up to 150KB and a number of email providers give you t…

Firefox Relay now works with emails up to 10MB: https://blog.mozilla.org/en/mozilla/latest-firefox-relay-inc... (Disclosure: Relay engineer.)

I might switch back to it as I had some delivery issues with Cloudflare on some messages, but the issue was the email size, as emails with attachments wouldn't come through. +1 for the change!

Re: An Ode to Apple’s Hide My Email

#250
post #242

Earlier quoted context omitted.

I use mozmail and on the fly emails are great but so easy to exploit and spam. For example, my custom domain is foo.mozmail.com. I enter my on the fly email address bar@foo.mozmail.com on attackers website. Voila. Now they know my custom domain name "foo" and can use it to send email to all possible on the fly addresses. e.g. 1@foo.mozmail.com 2@foo.mozmail.com so on and so forth. Now my custom domain name as a whole…

Yes, it is recommended to use a completely random email by default, and only use your custom domain as a fallback when you can't use the random one (e.g. when you have to give up your email somewhere in-person). We're looking into ways to make that clearer, because people's intuition tells them to use their custom subdomains by default.

That's right. Thanks for correction. I have been doing exactly that. Using custom domain email everywhere I needed. Will use generated emails from now.
Post reply on HN