undefined | Better HN

0 pointsbhauer7y ago0 comments

Many of us who operate our own mail services use a unique email address for every web service we use. You'd be surprised how many of these unique email addresses I've received spam at (and have subsequently blackholed). I would estimate less than 50% of the associated services ever report a data breach event. I figure either there has been an unreported breach or, possibly more likely, the service sold their userlist either directly to spammers or sold it to another group who was themselves breached. The upside, though, is that blackholing an address used for a single service is super simple and satisfying.

0 comments

varenc7y ago

As an anecdote to that:

I've received recruiter spam to "<my_email>+fuckyouadobe@gmail.com". Turns out when I was forced to signed up for an Adobe account years ago I'd added "+fuckyouadobe" to my email and, of course, Adobe was inevitably hacked. The leaked database had somehow made its way into recruiter software. The recruiter told me their vendor and when I got in touch with them (Aevy.com) they, of course, had no idea how that email got there.

Sadly these days people are probably smart enough to strip out these additions to gmail addresses. I would guess that's what Aevy did after I reached out...

anotherevan7y ago

I do something similar using https://www.spamgourmet.com/

Although many services are getting wise to many of these services and not let you sign up with their domains.

eridius7y ago

I would guess most companies are not in the business of selling their user email lists, but rather, shared the user's email with a third-party company that provided some service, and that third-party company then sold it.

_coveredInBees7y ago

You can do this with a gmail account too. If your email address is johnsmith@gmail.com...the following addresses all fwd to your main address

John.smith@gmail.com

Johnsmith+quora@gmail.com

Johnsmith+equifax@gmail.com Etc...

brocket7y ago

I used to use this technique for many years, but occasionally ran into issues with form validators rejecting the email address. I finally stopped because I never got spam from those email addresses (even in spam folder). I figured it's trivial for spammers to strip out the extra text, any half-decent spammer should know this trick. Also, I suspected they might change the +text to put the blame on someone else.

ALittleLight7y ago

Can't the spammer just s/'\+.*@'/'@'/ or something and throw away the + sign and all that follows? Or the company could do this if they were selling your email address.

tedunangst7y ago

While we're on the subject, all combinations of dots are equivalent. this.isme and th.isisme and thisis.me, etc. Finite variety, but good enough for a few generic throwaways and never filtered or stripped that I've seen.

ahje7y ago

I use domain.tld@subdomain.domain.tld combined with a catch-all address for that sub-domain. It gets around various email validation regexes that won't accept +.

scomp7y ago

Do you have any more info on running your own mail server? I looked at doing so but was promptly steered away because of blacklisting, servers that allow it and redundancy.

dhuramas7y ago

Can't recommend FastMail enough- it has aliases which automatically forward mail from xyz@alias.yourdomain.com to your alias@yourdomain.com - This is very similar in practice to the + trick with gmail[1] but with the benefit that your email addresses will pass all stupid Javascript email validation rules.

[1] https://www.thewindowsclub.com/gmail-address-tricks

ReidZB7y ago

You can also set up wildcard aliases, e.g. I have the equivalent of *@example.com, leading to addresses like hackernews@example.com.

aviv7y ago

Been using Fastmail for ages... great provider.

yerasame7y ago

I'm not sure what the up or downsides would be, but I personally just have all mail sent to *@mydomain.tld forwarded to a single email address. This way I can give each service a unique email address, while preserving the ability to divine whether a particular address has been lost or stolen, by looking at the sent to field.

Well, there's the obvious comfort of having all your mail in one place -- and all the obvious disadvantages that entails, I suppose.

j / k navigate · click thread line to collapse