Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Ode to Apple’s Hide My Email

empty.coffee

Post reply on HN
Print view View original

271–280 of 298 posts

Re: An Ode to Apple’s Hide My Email

#271

Post by masklinn »

mulmen wrote: post #239
masklinn wrote: post #237

Earlier quoted context omitted.

> I tried to do this but my dentist’s receptionist got confused and cancelled an appointment because “I used their email address”. Never had it go that far but I definitely had some odd reactions e.g. a support agent thinking I was a colleague. On the other hand, if you have a relatively common name it avoids people giving your email address then behaving aggressively when you tell them to stop. I’ve had a few friend…

> On the other hand, if you have a relatively common name it avoids people giving your email address then behaving aggressively when you tell them to stop. I’ve had a few friends hit this issue. I’m sorry, I can’t parse this. Can you try again? I used @ . My name was never involved in the address.

> I used @. My name was never involved in the address.

That's the point, if you don't use your name in your address, you can't be @, which third parties will provide as their email,

Because I use the same scheme you do I've never had that issue, but several friends with common names have hit the issue having registered to more "normal" hosts, often as somewhat early adopters and thus having gotten their pick.

Re: An Ode to Apple’s Hide My Email

#272

Post by 0xCMP »

megous wrote: post #191
KennyBlanken wrote: post #59

Earlier quoted context omitted.

> It's not as shiny as Apple's thing, but it's 100% selfhosted and I own the domain. Apple's system is "shiny" because it provides near total anonymity, whereas your setup has all the deliverabilty issues of a self-hosted domain and rather uniquely identifies you...at the domain level? I'm not sure why you are maintaining a hundreds-of-lines virtual table and a web UI, instead of just using a regex or two to capture…

Apple's system will only work until they decide to shut you out or shut down this service for whatever reason. Anonymity is not really a concern for most uses, privacy, longetivity and reliability of reception is though. I still want to use random unique addresses even for important and trusted services, not just for throwaway uses. So third party domain is not an option. I use self-hosted unique addresses mostly for…

I imagine Apple would come down on them pretty hard in the App Store if they did that so for most applications it's enough of a deterrent that most places would not do it. I also think that because Apple can mostly control which addresses and how many of them there are it can control the spam issues enough to avoid that problem. If not... then yea that's gonna happen in a few years. Would be short sighted for Apple to not do it though.

Re: An Ode to Apple’s Hide My Email

#273

Post by gruez »

justsomehnguy wrote: post #269
gruez wrote: post #190

Earlier quoted context omitted.

>Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets. That's obviously false if you bothered to do a bit of searching: https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#... >You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually c…

> That's obviously false if you bothered to do a bit of searching Technically correct, best kind of correct. Sure, it is not plaintext, but anyone with the access to the wire could MITM the connections. Maaaaybe something changed in the last ten years, but I never seen someone not accepting a connection with a self-issued certificate and any warnings (to the end user) if the receiver uses self-issued cert. Which make…

>but anyone with the access to the wire could MITM the connections. Maaaaybe something changed in the last ten years

The section on MTA-STS describes how that attack is mitigated.

Re: An Ode to Apple’s Hide My Email

#274

Post by tekknik »

josephg wrote: post #238
gruez wrote: post #190

Earlier quoted context omitted.

>Email is sent over cleartext, it is not encrypted. Anyone can read email if they can inspect packets. That's obviously false if you bothered to do a bit of searching: https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#... >You can email anyone on the internet as anyone and it will be delivered with NO validation. Clients may/may not validate any DKIM signature and the may/may not validate that it actually c…

> but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all. You would think so.. but its remarkable how easy it still is to forge email. My mum was recently the target of such a campaign. She's in the executive team at an international NGO. An attacker found her email address and a bunch of her contacts via the NGO's webpage. The…

The NGO could also force people to sign their emails. Refuse it from the SMTP if it’s not.

Re: An Ode to Apple’s Hide My Email

#277

Post by josephg »

tekknik wrote: post #274
josephg wrote: post #238

Earlier quoted context omitted.

> but for most services out there, having missing/invalid anti-spoofing measures will result in your mail ending up in spam or not delivered at all. You would think so.. but its remarkable how easy it still is to forge email. My mum was recently the target of such a campaign. She's in the executive team at an international NGO. An attacker found her email address and a bunch of her contacts via the NGO's webpage. The…

The NGO could also force people to sign their emails. Refuse it from the SMTP if it’s not.

Are you being serious right now? You understand that that'll never happen in our current technology landscape, right?

Outside of a few niche hardcore technologists, nobody knows what PGP is or how to use it. It would be hard enough getting my mum set up to PGP sign her own emails in Outlook, on the desktop and from her phone. (Is that even possible?). Let alone require anyone emailing her PGP sign their email too? Thats never going to happen for so many reasons, both technical and social.

I'm a software engineer and I tried setting up PGP years ago in thunderbird and it only worked for a few weeks, then it somehow broke. And then later I lost my PGP key. Oh, and then I started using webmail and PGP didn't work there at all.

And then later still I realised my public PGP key (signed by my web of trust) leaked details on the identity of my social network; which bothers me a lot more than any problems I've personally ever had with a forged identity.

PGP is dead. Let it go.

Re: An Ode to Apple’s Hide My Email

#278

Post by [deleted] »

masklinn wrote: post #271
mulmen wrote: post #239

Earlier quoted context omitted.

> On the other hand, if you have a relatively common name it avoids people giving your email address then behaving aggressively when you tell them to stop. I’ve had a few friends hit this issue. I’m sorry, I can’t parse this. Can you try again? I used @ . My name was never involved in the address.

> I used @ . My name was never involved in the address. That's the point, if you don't use your name in your address, you can't be @ , which third parties will provide as their email, Because I use the same scheme you do I've never had that issue, but several friends with common names have hit the issue having registered to more "normal" hosts, often as somewhat early adopters and thus having gotten their pick.

[deleted]

Re: An Ode to Apple’s Hide My Email

#279

Post by Vinnl »

ComodoHacker wrote: post #252
Vinnl wrote: post #240

Earlier quoted context omitted.

I can only speak for myself, but my honest answer would be that indeed, self-hosting probably won't be easy to do any time soon. We're trying to get a less technical audience to benefit from privacy protections too, and I don't think there's a good approach to get them to self-host as well, so focusing our limited time on other things is probably more effective. But who knows, actual use and user research do influenc…

>be able to see what code is running Is there any way to verify what code is actually running on your servers?

No 100% certain way, I think, but you can see that there are deployment scripts in place and are actively being touched. Combine that with what the cost of doing that while instead using an alternative method would be, and the way Mozilla is organised, and you can be pretty confident that it is, IMHO. But here, too, it still holds that that does not give the same level of assurances as self-hosting.
Post reply on HN