Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: After 10 years of experiments, custom username emails receive no spam

news.ycombinator.com

Post reply on HN
Print view View original

261–270 of 359 posts

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#261

Post by pinebox »

Since 2005 I have been using unique randomly generated email addresses for every retailer, rebate, forum, SaaS, etc. Out of these ~550 unguessable addresses I have deactivated ~15 due to security incidents on the other end. Notables from this short list:

- digikey.com (Feb. 2021)

- gamasutra.com (Jun. 2017)

- buydig.com

- kickstarter.com (May 2017)

- seagate.com (2016)

Of course this doesn't include the addresses I have had to disable because companies either started sending me "legitimate" promotional emails I did not request or they did not respect my unsubscribe requests (I believe this is what we used to call "ham").

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#262

Post by beprogrammed »

xdrosenheim wrote: post #240
LinuxBender wrote: post #36

Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good? Email databases for sale are not always for spam or malware. They are often used for tracking and cross marketing calculations. Placing a companies name in the address will signal a canary and they may likely filter your contact out of their database or at least flag it and treat it differently. I've been using email…

I have been thinking about using some sort of UUID-generator ([UUID]@mydomain.xz) whenever I sign up for a new site, but I just can not think of a _good_ way to keep track of them.

Generated algorithmically from their domain.

I believe sqrl uses a system like that.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#264

Post by mutt2016 »

simondotau wrote: post #253
reledi wrote: post #252

Earlier quoted context omitted.

I've seen this bug in prod while consulting. Bad regex.

Just adding an @ to the string match would make it a bit more robust. (Would still be vulnerable to jim@their.domain.my.domain , so add a $ on the end if it’s a regexp.) But even with the most rudimentary web-dev languages you can replace the inner string match with a lowercase transform, split on @ and perform an exact string compare. Insanely simple stuff. Probably still a one-liner in any sane/productive framework…

Frameworks usually have some sort of email parser. Email parsing is non trivial. But I agree matching .*?@domain.com$ would probably work fine.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#265

Post by prawn »

OrangeMonkey wrote: post #5

I'm glad you had a good experience. I had a different one. I've ran my own domain for longer than you have, and many emails have been compromised. Some are 100% from companies selling the emails to sister companies. The majority, though, is from a company itself being compromised by hackers / database access / etc. LinkedIn, Neopets, ProFlowers, TeeSpring, etc. I can go on.

Same. I get spam/phishing at a number of the custom email addresses I've used. Including adobe@, elance@, etc.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#266

Post by inopinatus »

I’ve been doing the same for thirty years. I do get spam to these addresses.

The most frequent recipients are the ones I rotate annually for LinkedIn. Mostly UCE rather than scams. Anecdotally it looks like 2019-2020 was a lousy period for their information security.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#267

Post by EGreg »

archi42 wrote: post #196
nibbleshifter wrote: post #154

Earlier quoted context omitted.

Yes. I've written code that does this for parsing leaked email lists before as part of a normalizing step.

Not sure why this is downvoted. I can imagine non-nefarious reasons to collect these lists.

Why do people downvote stuff that simply triggers them? This is useful info

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#269

Post by ttyprintk »

mancerayder wrote: post #263

Do you have an automation system to create the aliases that you can use ad-hoc without being in front of a terminal? Or do you just use + in the email address?

If you rely on a web-based generator, be sure to find an in-browser implementation. If I had one on the server-side, I wonder what passively collected secrets would float by.

Re: Tell HN: After 10 years of experiments, custom username emails receive no spam

#270

Post by artificialLimbs »

seanp2k2 wrote: post #156
YetAnotherNick wrote: post #126

Earlier quoted context omitted.

> A few vendors got upset that I had their name in the address rot13 FTW

too much work to remember each time for logins if it's something frequently used. The iCloud way of generating emails is great but only works well on my iDevices. I used to use endjunk.com for everything, and it was the same kind of "anything@you.endjunk.com" setup, but one day they just disappeared with no warning and I lost a few accounts because of that. Learned my lesson and just switched to GMail.

>> too much work to remember

You don't use a password manager?

Post reply on HN