Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use the Bitwarden forwarded email alias generator

bitwarden.com

Post reply on HN
Print view View original

41–50 of 66 posts

Re: How to use the Bitwarden forwarded email alias generator

#41

Post by zfa »

NoboruWataya wrote: post #39

This seems to just generate a random string to go with whatever domain I have set. Personally I prefer my email aliases to be of the form ` @ ` or ` @ `. That way if you do start getting unsolicited email it is crystal clear who is spamming you (or has sold/leaked your data). In fact, given it seems to just put a random string in front of a domain name you give it I'm a little curious as to why they need your API key…

Needs your API key as it needs to access the email forwarding service which you want to use with it.

It's not just making up a bullshit address, it's generating a random localpart then going to the email forwarding service you've integrated and having that service create an email forward to your real address per whatever settings you have there.

Any email sent to the address it generates (signup confirmations, password resets etc) need to get to you, after all.

This design is completely different to using @example.com. The latter is kind of useful for your use of 'who has sold my address' but has privacy drawbacks this design doesn't. e.g. if a spammer gets bestbuy@exmaple.com they know you prob also have twitter@exmaple.com, facebook@exmaple.com or whatever else and it's all just the same guy with the same inbox.

Truly 'random' addresses at generic forwarding services means that if Ashley Maddison gets breached again then your secret remains safe. sj4h3bd@forwarder.net could be anyone.

Re: How to use the Bitwarden forwarded email alias generator

#42

Post by zfa »

saghm wrote: post #21
Ringz wrote: post #9

It's been like this for years. However, with one of my own domains and a catch all rule in the e-mail server. Why? From time to time, some services require that you send emails with exactly this e-mail address as the sender. And that doesn't just work with most services. Because in such a case, you have to turn exactly this e-mail address into a real account with a mailbox.

For me, the value of using aliases on my own domain isn't anonymity, it's provenance; I can tell where my email was obtained from based on the the prefix used. If I get an email sent to git@ , I know that someone (or something) was looking at git logs to get it, if it's sent to resume@ , I know someone got it from my resume, etc.

I bet no spammer or salesperson would ever think of replacing such a generic localpart to get to your eyeballs.

Re: How to use the Bitwarden forwarded email alias generator

#43

Post by amelius »

dinglestepup wrote: post #32
amelius wrote: post #30

Earlier quoted context omitted.

I still don't understand why I would need Bitwarden if I use Firefox Relay, sorry.

Integration. When signing up with a new web service, you can just pop open Bitwarden and will generate both a unique email alias and a unique password, prefill the sign up form, and save the details to the password manager.

If I'm not mistaking, Firefox Sync will do that too.

Re: How to use the Bitwarden forwarded email alias generator

#44

Post by NoboruWataya »

zfa wrote: post #41
NoboruWataya wrote: post #39

This seems to just generate a random string to go with whatever domain I have set. Personally I prefer my email aliases to be of the form ` @ ` or ` @ `. That way if you do start getting unsolicited email it is crystal clear who is spamming you (or has sold/leaked your data). In fact, given it seems to just put a random string in front of a domain name you give it I'm a little curious as to why they need your API key…

Needs your API key as it needs to access the email forwarding service which you want to use with it. It's not just making up a bullshit address, it's generating a random localpart then going to the email forwarding service you've integrated and having that service create an email forward to your real address per whatever settings you have there. Any email sent to the address it generates (signup confirmations, passwo…

> It's not just making up a bullshit address, it's generating a random localpart then going to the email forwarding service you've integrated and having that service create an email forward to your real address per whatever settings you have there.

Fair enough - the one I use automatically creates an alias whenever it receives an email at the relevant domain so there's no need to manually create one, I assumed the other services were the same.

Re: How to use the Bitwarden forwarded email alias generator

#46

Post by saghm »

zfa wrote: post #42
saghm wrote: post #21

Earlier quoted context omitted.

For me, the value of using aliases on my own domain isn't anonymity, it's provenance; I can tell where my email was obtained from based on the the prefix used. If I get an email sent to git@ , I know that someone (or something) was looking at git logs to get it, if it's sent to resume@ , I know someone got it from my resume, etc.

I bet no spammer or salesperson would ever think of replacing such a generic localpart to get to your eyeballs.

Why would they want to spend effort trying to brute-force addresses to show me emails that they already have the ability to sent to me and I didn't generate them any revenue from?

Re: How to use the Bitwarden forwarded email alias generator

#47

Post by zfa »

saghm wrote: post #46
zfa wrote: post #42

Earlier quoted context omitted.

I bet no spammer or salesperson would ever think of replacing such a generic localpart to get to your eyeballs.

Why would they want to spend effort trying to brute-force addresses to show me emails that they already have the ability to sent to me and I didn't generate them any revenue from?

No idea, just pointing out it is such an obvious alg it doesn't really show provenance.

I used similar (well, plus addressing with localpart=name+) a long time ago and once got emails to name+paypal@example.com even though that was a suffix I'd never used. Some enterprising person out there had obviously obtained one or more of my service-specific addresses and was trying to game my attention by changing the identifier to something 'important'. That's when I personally ditched the approach.

Re: How to use the Bitwarden forwarded email alias generator

#48

Post by saghm »

zfa wrote: post #47
saghm wrote: post #46

Earlier quoted context omitted.

Why would they want to spend effort trying to brute-force addresses to show me emails that they already have the ability to sent to me and I didn't generate them any revenue from?

No idea, just pointing out it is such an obvious alg it doesn't really show provenance. I used similar (well, plus addressing with localpart=name+ ) a long time ago and once got emails to name+paypal@example.com even though that was a suffix I'd never used. Some enterprising person out there had obviously obtained one or more of my service-specific addresses and was trying to game my attention by changing the identif…

"Provenance" might be have been a bit too strong; maybe I should have said "strong signal". It's an additional piece of info that will almost always identify the source, but in the rare exceptions it's not any worse than if I just used a single address for anything.

Re: How to use the Bitwarden forwarded email alias generator

#49

Post by noman-land »

niklasmtj wrote: post #15

Oh this is funny to see. I just posted a blog post talking about Email Aliases an hour ago without knowing about the Bitwarden announcement. I would love to see aliases being promoted more and more by companies. In the end most companies want to get in touch with you via e.g. a newsletter. So why do they need exactly your private email and not just an email alias. In the end they're reaching the same person.

They don't want to send you a newsletter. They want to get you to click a unique, personalized tracking link so they can drop a cookie in your browser and start tracking everything you do and tying it back to a single, named identity in their contacts database that they can then try to extract money from.

Re: How to use the Bitwarden forwarded email alias generator

#50

Post by saghm »

dinglestepup wrote: post #26
saghm wrote: post #21

Earlier quoted context omitted.

For me, the value of using aliases on my own domain isn't anonymity, it's provenance; I can tell where my email was obtained from based on the the prefix used. If I get an email sent to git@ , I know that someone (or something) was looking at git logs to get it, if it's sent to resume@ , I know someone got it from my resume, etc.

In most cases you can have the same level of provenance with a plus addressed email, without needing to support a custom domain.

I'm not sure if the comment I replied directly to got deleted or if I accidentally replied to the wrong thread or something, but for some reason I thought I had replied about provenance specifically in response to a comment saying that separate prefixes didn't provide anonymity. Using a custom domain is mostly a fun novelty for me, and if separate prefixes didn't provide any value, I'd still just use use a single prefix on my custom domain because I like it.
Post reply on HN