Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: After 10 years of experiments, custom username emails receive no spam

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 359 posts

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#251

Post by ChristopherDrum »

OrangeMonkey wrote: post #5

I'm glad you had a good experience. I had a different one. I've ran my own domain for longer than you have, and many emails have been compromised. Some are 100% from companies selling the emails to sister companies. The majority, though, is from a company itself being compromised by hackers / database access / etc. LinkedIn, Neopets, ProFlowers, TeeSpring, etc. I can go on.

Yes, I have been doing exactly the same for at least 15 years now and have had a wide variety of throwaway/registration emails compromised.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#252

Post by reledi »

simondotau wrote: post #218
LinuxBender wrote: post #36

Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good? Email databases for sale are not always for spam or malware. They are often used for tracking and cross marketing calculations. Placing a companies name in the address will signal a canary and they may likely filter your contact out of their database or at least flag it and treat it differently. I've been using email…

> A few vendors got upset that I had their name in the address A few years ago I created an account with a freemium publisher with the email address their.domain@my.domain and as soon as I logged into my account I had full unlimited access to all content. I suspect their system had a routine that detected staff accounts based on a string search for their domain.

I've seen this bug in prod while consulting. Bad regex.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#253

Post by simondotau »

reledi wrote: post #252
simondotau wrote: post #218

Earlier quoted context omitted.

> A few vendors got upset that I had their name in the address A few years ago I created an account with a freemium publisher with the email address their.domain@my.domain and as soon as I logged into my account I had full unlimited access to all content. I suspect their system had a routine that detected staff accounts based on a string search for their domain.

I've seen this bug in prod while consulting. Bad regex.

Just adding an @ to the string match would make it a bit more robust. (Would still be vulnerable to jim@their.domain.my.domain, so add a $ on the end if it’s a regexp.)

But even with the most rudimentary web-dev languages you can replace the inner string match with a lowercase transform, split on @ and perform an exact string compare. Insanely simple stuff. Probably still a one-liner in any sane/productive framework.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#254

Post by hacym »

Side note: if you’re an engineer that implements your sign up to force email from a “real domain”, screw you. I’ve run into multiple sites that force you to have a Gmail, Yahoo, or whatever else account and it’s obnoxious. It does nothing. Stop.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#256

Post by kazinator »

> Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good?

My experience with generated one-per-contact addresses is similar. I think pretty much 100% spam came from the ones I use for Usenet.

In my case, mail destined for these addresses bypasses all anti-spam checks, so I know it's not the spam filters: there are none.

(Filtering mail destined for generated addresses is counterproductive; you often need them in situations where maximum deliverly reliability is paramount. Plus, such a system is a complete anti-spam scheme; it doesn't need to be combined with any other.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#257

Post by yellow_lead »

Hi there,

On August 8th, 2022, DigitalOcean discovered that our Mailchimp account had been compromised as part of a wider Mailchimp Security Incident. As a result, a number of DigitalOcean customer email addresses may have been viewed by an unauthorized individual.

Impact to you No customer information other than email address was impacted

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#258

Post by kypro »

I had to abandon an email address for similar reasons. I added a mailto link on my website and within weeks started to notice some spam. I then removed the mailto link and replaced in the format of, "me [at] domain [dot] com" but it didn't help much.

Eventually I created a new email address and just used that all high priority stuff that I needed to read. All was good for a while but then a couple of companies that have my email address got hacked and I guess my info must have been sold because since then I've started receiving spam emails again. It's manageable at the moment, but I wonder if there will again come a time that I have to start over with a new email address.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#259

Post by jimmydddd »

saxonww wrote: post #33
OrangeMonkey wrote: post #5

I'm glad you had a good experience. I had a different one. I've ran my own domain for longer than you have, and many emails have been compromised. Some are 100% from companies selling the emails to sister companies. The majority, though, is from a company itself being compromised by hackers / database access / etc. LinkedIn, Neopets, ProFlowers, TeeSpring, etc. I can go on.

The worst offender for me is an email address I used to get a fishing license from the state fish and wildlife group. As soon as I did that, I started getting advertisements from some outfitter/prepper type places. Not sure if they bought the address or if licensee info is public in my state.

Probably public. In NJ, you get snail mail solicitations when you register stuff at the DMV.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#260

Post by layer8 »

I’ve done the same, and there have been a dozen or so online shops, usually smaller-sized ones, for whose associated custom addresses I’m receiving spam. I don’t think they are selling their data, rather, they are getting hacked by third parties.

There’s also cases like Dropbox who had a data breach a few years back, and for whose associated addresses I’m receiving some spam since.

Post reply on HN