6 ms·

Would be great if I could just provide a hash of my e-mail address.

by comboy 11y ago

Johnny555 11y ago
Agreed - I use a lot of email aliases (i.e. myname+merchantname@gmail.com) and I don't really want to upload a list of them to a website to see if any were compromised, I'd feel much better about a hash. Either that or allow a wildcard "myname+*@gmail.com" so I can check them all at once, but that probably has privacy issues of its own.
- peterwwillis 11y ago
  Just curious, why do you use a different e-mail account for every merchant? All you need is different passwords, and then maybe label filters if you don't want them ending up in your Inbox.
  - untog 11y ago
    That isn't an account - Gmail sends anything with a +whatever in it to the address without the plus. So, me+mine@gmail.com goes to me@gmail.com. It's useful for exactly the filtering you are describing - and I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so)
    - smoyer 11y ago
      It's part of the specification ... Anything after the plus sign is considered a comment.
      - sp332 11y ago
        I'm pretty sure that's not true. '+' is allowed in an email address, but it's just a normal character, not a comment. Comments are made with parentheses. https://en.wikipedia.org/wiki/Email_address#Syntax https://en.wikipedia.org/wiki/Email_address#Syntax
        silix 11y ago
        you need to scroll down in your link. https://en.wikipedia.org/wiki/Email_address#Sub-addressing https://en.wikipedia.org/wiki/Email_address#Sub-addressing
        sp332 11y ago
        That's a different "spec" which may or may not be implemented by any given email provider.
    - logicallee 11y ago
      it's literally security by obscurity since gmail does not allow a genuine + in emails, so: >I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so) ...is Google dropping the ball by doing something insecure. The secure version is to be able to assign a randomized alias, for example I should be able to request an alias and get a high-entropy string like buffaloaerypyrite which is associated with "me+fromDatingSite", which is this great group I heard for meeting singles who are into knitting, my biggest hobby! Then I can give DatingSite the address "buffaloaerypyrite@gmail.com" and have it go to my inbox and be marked fromDatingSite, just as it does currently. But if escorts start sending me mail to "me+fromDatingSite" I don't have to be able to rely on the security by obscurity that protects me from getting spam that is not marked with that source, if any of them figure out how to remove the + so that they can reach the inbox I read everything in. It's a simple key-value lookup table and would close a security hole that allows spammers to reach you. It is mandatory for Google to let me give out "buffaloaerypyrite" instead of "me+fromDatingSite". Unfortunately, instead they have a non-scalable solution that doesn't work. This is why I'm faced with a choice, and can either use an unsecure version and rely on security by obscurity, or use a real throwaway email. I use a real throwaway email anyone can read (mailinator). Because Google's engineers either don't understand how to secure their solution, or believe that security by obscurity is sufficient. I've never once in my entire life given out my gmail email address with a + in it, even though I know exactly how this method works and how to use it. Never once. I'm not stupid enough to use security by obscurity. But it's great that they have it and are a single key-value lookup from having it work properly. Any day one of them will realize the implications and implement the solution, which can be prototyped in 7 minutes in any technical stack and be fully pushed out within a day or two. It's trivial. I have faith they will realize it sooner or later. You can do it, Google. Be better.
      - DigitalJack 11y ago
        I can't tell if this is serious or not.
        logicallee 11y ago
        Yes, I'm serious. I don't only use mailinator: some sites blacklist mailinator and somehow blacklist its alises (I know devnullmail off the top of my head, to name one of its aliases). For this reason I also have a gmail account dedicated to spam. I just checked for you, and have received 6 pieces of mail to it in the past three day, to the inbox (not filtered as spam). But hey, you go ahead and continue to rely on the fact that spammers will never ever figure out how to apply a s/\+(.+)@gmail.com/@gmail.com/g to a list of email addresses (since I and most people use gmail.com and not some other domain). I don't know how much spam my mailinator accounts get, since I don't check them. But let's check throwaway@mailinator.com since I bet someone has picked that name. In the past hour this is the spam it got: http://imgur.com/PS7O3Ov http://imgur.com/PS7O3Ov That's 9 pieces of spam in 2 hours. You think Dr Dave, who personally addresses someone who signed up somewhere as (throwaway) in his subject line, is above applying a regex? Do you think the person who sent out "1 Sl!tty Friend Alert" is above applying that regex? You think that Kaylyn, who sent out "Two cute ebony teens in threesome" is above applying that regex? That's nice. That's the definition of security by obscurity. Literally the definition. So, yes, I'm serious.
- Armaron 11y ago
  I asked him that same question: https://twitter.com/troyhunt/status/692328070506749952 https://twitter.com/troyhunt/status/692328070506749952 He says too little people use the feature to implement it.
- original_idea 11y ago
  The problem with the +suffix approach is that any spammer worth a salt is going to strip anything between + and @ Great for organization, but horrible as a SPAM preventer.
  - lazaroclapp 11y ago
    Unless you default deny (send to SPAM) any email received without the +suffix field. You can then provide each entity (service or friend) a different, randomly generated, +suffix "token". You can even set filter rules so that the token must match the from field or at least the domain therein (forge-able as it is...). Admittedly maintaining this system by hand would be a pain. But if you use a dedicated email for service log-ins and a browser extension to generate the tokens (and unique passwords), then it could be quite workable.
smkdtr 11y ago
I like this idea. This way the email address remains private till the first time it shows up in a dump.
peterwwillis 11y ago
Troy addresses this in this blog post: http://www.troyhunt.com/2015/11/im-sorry-but-your-email-address-is-not.html http://www.troyhunt.com/2015/11/im-sorry-but-your-email-addr... IMHO it's not worth the 16 gigs of storage, the time it takes to sanitize, process & store all the hashes, nor the incredibly minor risk that somebody could intercept it going over HTTPS from your browser to his app server - data which is already public anyway.
manigandham 11y ago
Why? Email addresses are already public, what are you protecting here?
- csirac2 11y ago
  For me, I find it interesting to see which site sells my email address to unrelated marketers/spammers.

Would be great if I could just provide a hash of my e-mail address.

by comboy 11y ago

Would be great if I could just provide a hash of my e-mail address.

Agreed - I use a lot of email aliases (i.e. myname+merchantname@gmail.com) and I don't really want to upload a list of them to a website to see if any were compromised, I'd feel much better about a hash. Either that or allow a wildcard "myname+*@gmail.com" so I can check them all at once, but that probably has privacy issues of its own.

peterwwillis 11y ago
Just curious, why do you use a different e-mail account for every merchant? All you need is different passwords, and then maybe label filters if you don't want them ending up in your Inbox.
- untog 11y ago
  That isn't an account - Gmail sends anything with a +whatever in it to the address without the plus. So, me+mine@gmail.com goes to me@gmail.com. It's useful for exactly the filtering you are describing - and I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so)
  - smoyer 11y ago
    It's part of the specification ... Anything after the plus sign is considered a comment.
    - sp332 11y ago
      I'm pretty sure that's not true. '+' is allowed in an email address, but it's just a normal character, not a comment. Comments are made with parentheses. https://en.wikipedia.org/wiki/Email_address#Syntax https://en.wikipedia.org/wiki/Email_address#Syntax
      - silix 11y ago
        you need to scroll down in your link. https://en.wikipedia.org/wiki/Email_address#Sub-addressing https://en.wikipedia.org/wiki/Email_address#Sub-addressing
        sp332 11y ago
        That's a different "spec" which may or may not be implemented by any given email provider.
  - logicallee 11y ago
    it's literally security by obscurity since gmail does not allow a genuine + in emails, so: >I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so) ...is Google dropping the ball by doing something insecure. The secure version is to be able to assign a randomized alias, for example I should be able to request an alias and get a high-entropy string like buffaloaerypyrite which is associated with "me+fromDatingSite", which is this great group I heard for meeting singles who are into knitting, my biggest hobby! Then I can give DatingSite the address "buffaloaerypyrite@gmail.com" and have it go to my inbox and be marked fromDatingSite, just as it does currently. But if escorts start sending me mail to "me+fromDatingSite" I don't have to be able to rely on the security by obscurity that protects me from getting spam that is not marked with that source, if any of them figure out how to remove the + so that they can reach the inbox I read everything in. It's a simple key-value lookup table and would close a security hole that allows spammers to reach you. It is mandatory for Google to let me give out "buffaloaerypyrite" instead of "me+fromDatingSite". Unfortunately, instead they have a non-scalable solution that doesn't work. This is why I'm faced with a choice, and can either use an unsecure version and rely on security by obscurity, or use a real throwaway email. I use a real throwaway email anyone can read (mailinator). Because Google's engineers either don't understand how to secure their solution, or believe that security by obscurity is sufficient. I've never once in my entire life given out my gmail email address with a + in it, even though I know exactly how this method works and how to use it. Never once. I'm not stupid enough to use security by obscurity. But it's great that they have it and are a single key-value lookup from having it work properly. Any day one of them will realize the implications and implement the solution, which can be prototyped in 7 minutes in any technical stack and be fully pushed out within a day or two. It's trivial. I have faith they will realize it sooner or later. You can do it, Google. Be better.
    - DigitalJack 11y ago
      I can't tell if this is serious or not.
      - logicallee 11y ago
        Yes, I'm serious. I don't only use mailinator: some sites blacklist mailinator and somehow blacklist its alises (I know devnullmail off the top of my head, to name one of its aliases). For this reason I also have a gmail account dedicated to spam. I just checked for you, and have received 6 pieces of mail to it in the past three day, to the inbox (not filtered as spam). But hey, you go ahead and continue to rely on the fact that spammers will never ever figure out how to apply a s/\+(.+)@gmail.com/@gmail.com/g to a list of email addresses (since I and most people use gmail.com and not some other domain). I don't know how much spam my mailinator accounts get, since I don't check them. But let's check throwaway@mailinator.com since I bet someone has picked that name. In the past hour this is the spam it got: http://imgur.com/PS7O3Ov http://imgur.com/PS7O3Ov That's 9 pieces of spam in 2 hours. You think Dr Dave, who personally addresses someone who signed up somewhere as (throwaway) in his subject line, is above applying a regex? Do you think the person who sent out "1 Sl!tty Friend Alert" is above applying that regex? You think that Kaylyn, who sent out "Two cute ebony teens in threesome" is above applying that regex? That's nice. That's the definition of security by obscurity. Literally the definition. So, yes, I'm serious.
Armaron 11y ago
I asked him that same question: https://twitter.com/troyhunt/status/692328070506749952 https://twitter.com/troyhunt/status/692328070506749952 He says too little people use the feature to implement it.
original_idea 11y ago
The problem with the +suffix approach is that any spammer worth a salt is going to strip anything between + and @ Great for organization, but horrible as a SPAM preventer.
- lazaroclapp 11y ago
  Unless you default deny (send to SPAM) any email received without the +suffix field. You can then provide each entity (service or friend) a different, randomly generated, +suffix "token". You can even set filter rules so that the token must match the from field or at least the domain therein (forge-able as it is...). Admittedly maintaining this system by hand would be a pain. But if you use a dedicated email for service log-ins and a browser extension to generate the tokens (and unique passwords), then it could be quite workable.

smkdtr 11y ago

I like this idea. This way the email address remains private till the first time it shows up in a dump.

peterwwillis 11y ago

Troy addresses this in this blog post: http://www.troyhunt.com/2015/11/im-sorry-but-your-email-address-is-not.html http://www.troyhunt.com/2015/11/im-sorry-but-your-email-addr... IMHO it's not worth the 16 gigs of storage, the time it takes to sanitize, process & store all the hashes, nor the incredibly minor risk that somebody could intercept it going over HTTPS from your browser to his app server - data which is already public anyway.

manigandham 11y ago

Why? Email addresses are already public, what are you protecting here?

csirac2 11y ago
For me, I find it interesting to see which site sells my email address to unrelated marketers/spammers.