8 ms·
Mailhero – a more permanent temporary email
- MasterYoda 10y agoWhat it is... Create a new uniqe mailhero email when you sign up to a new service etc. Mailhero will keep forward those emails to your real one until you choose not to. So if that email ends up in a spamming list and you get starting to get alot of unwanted email from different spammers that could be hard to block you could just stop the forwarding. So it works like a temporary email but is more permanent at the same time. And dont stop working after like 24h like many other temporary email services. (Sorry for a shitty title)
- trickster_ 10y agoLooks like a good title to me...!
- phyzome 10y agoLooks similar to https://www.spamgourmet.com/ https://www.spamgourmet.com/ which I used to use back in the day... and I guess is still a thing!
- FreezerburnV 10y agoYou mentioned it before I could! I'm somewhat amazed that site is still ticking, but I'm happy it is. I should make use of it more often... It even has some really nice features like being able to send email from your temporary address and more manual management of each temporary address you create. I highly recommend checking it out, even if the website looks old and strange, it's solid. EDIT: Oh, and you can download the code for it and run it yourself if you want. Fantastic.
- yborg 10y agoEverything old is new again... still use SG everywhere that doesn't filter it, I'm actually kind of glad the kidz have never heard of it because a surprising number of newer sites don't.
- nfirvine 10y agoHow is this different/better than Gmail's address+spammer@gmail.com?
- ceejayoz 10y agoSpammers know to take off the +spammer part.
- jalami 10y agoAlso some websites won't let you put + in the address despite it being a valid character per protocol. Crippling email sign ups for one company, astonishing. Fastmail has subdomain addressing. eg. hackernews@myemail.fastmail.com which is a lot harder to detect.
- JonathonW 10y agoI like Yahoo's approach-- they do their disposable email aliases like this: basename-spammerspecificsuffix@yahoo.com Where basename is user-chosen (and not necessarily related to the real email address), and the suffix has to be registered ahead of time (so a spammer can't just start randomly generating suffixes to avoid filters).
- jweir 10y agoCouldn't spammers just start sending to (rand).username@mailhero ?
- tempestn 10y agoAlso you have to maintain the rules filtering out all the +spammers indefinitely. Presumably with this service or something like it, whenever you wanted to you could just create an entire fresh id. (As well as the ability to turn off specific addresses as they describe.)
- kijin 10y agoIf this becomes popular, what stops spammers from figuring out that the part before the last dot in the username can be anything? A lot of shady folks already know about Gmail's plus-addressing trick. If I were a spammer and I found that foobar.username@mailhero.io didn't work, I would just try bazbaz.username@mailhero.io. Perhaps you could set up the system to only accept aliases that have been explicitly configured. But that would make Mailhero a bit inconvenient for regular users, since they would have to add an alias before using it elsewhere. Another possibility would be to add a big button in the dashboard that automatically generates a plausible address (e.g. barack.hillary.trump@mailhero.io) with no connection whatsoever to your regular username or other aliases. No need for the user to decide what alias to use, and no way for a spammer to figure out a working alias.
- raihansaputra 10y agoi think an easy way is to send a notification email for every new sub-email "registered". No email gets forwarded until the new sub-email is verified.
- guptaneil 10y agoSounds awesome, would love to try it. Spent 5 minutes trying to sign up, but every variation of usernames that I tried were taken. This normally wouldn't be an issue to complain about, except that in order to test whether a username is available or not, I have to enter the username, password, and captcha every time. Please please please tell me whether or not a username is taken as a type it before I go further.
- jrwoodruff 10y agoSame awful experience here. Sounds great, was terrible.
- matart 10y agoI also had every username I tried come up as taken. Even ones I found on main stream sites.
- keehun 10y agoI'm having a similar experience. I have a username that is NEVER taken... Not even on Gmail, and yet it was not available. I sense that the form is wrong, or maybe it's not accepting new users right now.
- derekja 10y agoyeah, total fail. Every variation of my fairly uncommon name including random numbers at the end of my full name.
- trickster_ 10y agoYes, my bad! I did not expect my site to get hacker news'ed while I was sleeping and I hadn't scaled up the web server for that... You can try again now. :) The really good news is that all mails are always buffered on another server, so even if the whole thing was to go down, all mails will reach its destination in a timely manner.
- winterswift 10y agoSignup seems to be broken? I've tried a few 'random' (keyboard-mashing) usernames to no avail. As guptaneil pointed out, some immediate form feedback on username availability would be very helpful as well.
- schneems 10y agoI made something almost exactly like this 6 years ago. Called whyspam.me Good luck.
- schneems 10y agoAlmost forgot I open sourced it when I took it down. https://github.com/schneems/WhySpam https://github.com/schneems/WhySpam
- mhw 10y agoThe domain has now been taken over by scammers, so it might be worth removing the links from the github project.
- ehnto 10y agoI feel like this kind of service would be used for nefarious means pretty regularly, and subsequently the people trying to track that kind of activity would be knocking on the door quite often. Did you find that to be an issue? Once upon a time I considered a similar service that could be abused and ultimately chose not to go ahead because it simply "isn't my problem" to deal with those two groups of people. I wanted no part in it, for good or evil, even as an unbiased conduit.
- jbergstroem 10y agoThis here is unfortunately why services like these are a bad idea. If you don't control the MX pointer you need to accept that these mails can be lost. A lot of mail providers seems to support the + syntax and similarly so MTA's like postfix. I would suggest you direct your attention there instead.
- aembleton 10y agoThis looks really good. I've just seen this message though when I verified my email address: "Do not give out your bare-naked mailhero address (xxx@mailhero.io). Always make sure you add something before the dot, otherwise you can't stop the mails from arriving!" If anyone from Mailhero is here - why don't you block the bare-naked emails? If this becomes popular then marketeers can just search for @mailhero.io addresses and strip off any string followed by a dot so that they can spam you.
- sigio 10y agoIt would be easy enough to just prepend something random to the bare email's anyway, or to replace the random bit with every e-mail sent. So you can still spam mailhero users.
- biot 10y agoOn the same note, they can just construct <random chars>.user@mailhero.io and email sent there will be forwarded to you as if that's the custom email address you sent out.
- ivotron 10y agoAdditionally, with Inbox one can flag stuff as lower priority or delay delivery of a bundle
- gingerlime 10y agoLove this idea, and the copywriting on the page is absolutely brilliant! I hand-rolled my own solution a while back on my own server, simply creating a random forwarder and "tagging" it with a description, so I can always go back and lookup what fw839kopa4 was for... It's a ugly hack, but works. My ugly hack has the added benefit of not accepting just any email address, but only those I explicitly defined. On the flip side, I have to run this small script and can't just give out citibank.myname@mydomain.com to anyone on the fly.
- trickster_ 10y agoThank you for the compliment about the copywriting! I did try to put effort into explaining what Mailhero actually does and to make sure that I explained why I made it instead of pretending to be somebody else. :)
- throwanem 10y agoSpammers often strip dot aliases in my experience. This doesn't seem like doing anything to solve that problem. I mean, if citigroup.joe gets dot-stripped, then citigroup@mailhero.io gets that spam instead of joe, but odds are joe will just end up getting somebody else's spam anyway, so it's not really much of a win unless you're careful to pick a username that won't be used as an alias, and then you have the problem of having to give out addresses like citigroup.rkcj92o8I@mailhero.io. Not seeing the value prop over Mailinator.
- dijit 10y agoWould they be stripped? The traditional alias separator is a '+' (dijit+hackernews@google.com) and periods are part of email names, thus the address itself: (jan.harasym@google.com)
- throwanem 10y agoWell, I've gotten spam that had it stripped; the name was a bogus one that I gave out in combination with a specific dot-aliased address, but the address in the To: header was without the alias. I can't say how often it happens, but with major mail providers (including Google, IIRC) widely known to support arbitrary dot aliases for throwaway addressing, it seems like a reasonable ploy from the spammer's point of view.
- dijit 10y agoGoogle definitely do not support dot aliasing, I've had email addresses for gmail with dots in them and so has my mother. Thats dangerous if you allow people to sign up for email addresses with dots and then use that as an alias seperator. So dangerous I would argue they wouldn't do it.
- amdavidson 10y agoGmail explicitly ignores dots in email usernames[1]. 1: https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...
- crazydiamond 10y agoI have been using gishpuppy for several years. It actually works. It's a free service, you create an email for any website that asks for one. There are addons/extension for firefox and perhaps other browsers, too. http://www.gishpuppy.com/ http://www.gishpuppy.com/
- newman314 10y agoWhy can't it just be some random hash? For me, a key benefit of a disposable mail account is not to have any identifiers including username.
- barbs 10y agoYou could make your username be some random hash?
- wtbob 10y ago> You could make your username be some random hash? Why not? 285e5c0452918bf77370c4a013317be4cf5e1ff690cc33a7346e837f59cdca58@foobarbaz.invalid is, I believe, a valid email address. If that's too long, you can always truncate it.
- Akkuma 10y agoYou could simply use something like base64 on a username you regularly use as the hash.
- ruffrey 10y agoCool idea. I run mailsac.com and it kind of does this. Do you have a business model? Times be tough in the temporary email niche
- theaustinseven 10y agoI think the best part about this is that it makes it easy to see who is selling your email. That can bring some accountability to these services that collect your email, and supposedly never use it.
- dingaling 10y ago> That can bring some accountability to these services that collect your email, and supposedly never use it. In my experience, though, they deny everything when you follow-up. At one point I started receiving third-party spam to santander_currentacct@[domain]. I contacted Santander, my bank, to ask how that e-mail address had leaked. They insisted that I must have used it elsewhere since their systems were watertight. I changed it to something like santander_dontspamme@ and sure enough after a few months the spam started. This time Santander didn't even reply to my complaints. I subsequently moved my current accounts to another bank, leaving £0.01 in several Santander accounts just to keep them open.
- findjashua 10y agoWith gmail, you can create a custom email for each service, like so: youremail+service@gmail.com Later on, if the service doesn't let you unsubscribe, or sells your email to other spammers, you can just set a filter to trash emails sent to youremail+service@gmail.com
- yAnonymous 10y agoThe main problem with this is that many services won't allow your mail address to have a + in it.
- kenshaw 10y agoAnyone with half a clue that is doing heavy marketing via email, knows to strip the stuff after the +. BTW, the + is part of the email specification, and technically any email server not supporting it is broken.
- cscharenberg 10y agoAdditionally, either through malice or mistake many email forms disallow + signs entirely.
- inopinatus 10y agoAlthough '+' is an acceptable symbol, there's actually nothing in the RFCs that mandates sub-addressing behaviour. The closest you'll get is RFC5233 that defines it for the Sieve filtering language. So although very common, sub-address behaviour is not a standards requirement and should not be presumed. By "heavy marketing" I presume you mean spammers. If not, be warned, sub-address stripping will mean nondelivery in some cases and could trigger blacklisting via honeypots.
- lewisl9029 10y agoI've been doing something similar, except with a Google Apps catch-all address. Unfortunately, a lot of spammers use BCC, so AFAIK for those emails there's no way to figure out which email address was compromised, and thus no easy way to filter them out en masse.
- deleted 10y ago[deleted]
- nicois 10y agoYou need to trust your mail relay to not go offline or you lose the ability to reset your password etc. Worse would be if someone used the relay to intercept a password reset and pwn you. Better to implement filters on Gmail or whatever, server side with the + suffix.
- Gaelan 10y agoSpammers are going to figure out how to manipulate these if it gains any traction; if I were a spammer, I would just send each email from a different MH email address with the same username. See also Throttle[0], which does a similar thing using a browser extension to generate random emails addresses. [0]: https://throttlehq.com https://throttlehq.com
- oh_sigh 10y agoYou can maintain a whitelist on your real email client with only allowed forwarding addresses from mailhero. mark everything else as spam
- raihansaputra 10y agoWhat would it do if people would just strip the prefixes before the dot just for mailhero? Would the email still gets forwarded? Should I shut down the account?
- aembleton 10y agoIt suggests that that is exactly what could happen: "Do not give out your bare-naked mailhero address (xxx@mailhero.io). Always make sure you add something before the dot, otherwise you can't stop the mails from arriving!" Seems like that should be a simple fix for them.
- wiradikusuma 10y agoSince I have Google Apps (eg bla.com), I just turn on "catch-all email" settings, and whenever I join a service, I'll use "servicename@bla.com" (eg paypal@bla.com). Interestingly, sometimes I receive spam from AnotherService sent to OriginalService@bla.com. From there you can see which services sell their data to 3rd party.
- gdiepen 10y agoI have been running a similar service for myself on my own exim mailserver for a couple of years now and very happy with it. Provided explanation on how to achieve this on my blog https://www.guidodiepen.nl/2013/02/catch-almost-all-in-exim-only-address-with-specific-pattern/ https://www.guidodiepen.nl/2013/02/catch-almost-all-in-exim-... Whenever an address is receiving too much spam, I just blacklist it at the server level, ensuring I don't have to filter it anymore in my mail client since the server won't even accept it. Have to say that it is always funny when a person asks for my email address and it confuses them when the address part before the @ sign contains their company name :) Often get the question whether I also work at the company or so.
- trickster_ 10y agoThat was a nice tutorial! I did something similar too before creating Mailhero. And regarding the confusion about stuff before the @-sign: I have gotten "Wow, you work here?!" a million times too... :)
- Jaruzel 10y agoDitto, I get that a lot too. That pregnant pause on the other end of the line after you get as far as <companyname>@... What I have discovered as well, is that gmail/hotmail/yahoo addresses are so ubiquitous, that call centre staff get very confused when your email address doesn't end in one of the 'big three' domain names. Also don't get me started on the problems I've had trying to explain that yes, .io is a valid domain ending for an email address...
- mortenlarsen 10y agoI have run a server with a similar setup for many years. And some people get really confused. It can be quite funny sometimes. The best moment was my SO explaining to someone on the phone, why the email address included their company name. Paraphrasing: If you get hacked or sell my email I will know it was you. So don't sell it, and make sure you stay on top of your security. I used to contact companies by email after they leaked my throwaway email address, but I don't any more, because some got angry and others were just confused.
- trickster_ 10y agoAnother thing I am working on for Mailhero is to start publicly listing sites/organizations that have leaked mail addresses. This list currently includes Coca Cola, Adobe, Neteller and others.
- gingerlime 10y agoYou can add box.net to the list. I used a one-off email address on their service and it got leaked. They were at least honest enough to confirm it did indeed happen to them: We were recently informed by a handful of users that they had received spam email at the address associated exclusively with their Box account. We scoured our own systems and checked every possible scenario, and didn't find any evidence of our systems being compromised. Thanks to information sent to us by our customers, we were able to pin down that a third-party email service we used to send our newsletter to select users in February, March and April had been compromised. No other information beyond email addresses were ever exposed to this vendor. We sincerely apologize for the inconvenience this has caused our users. We continue to be committed to your privacy and keeping their confidential information safe. As a result of this issue, we're leaving this particular service provider immediately and consolidating all of our customer communication efforts within a single vendor with more robust security practices.
- Jaruzel 10y agoLike many of you, I've rolled my own interpretation of this solution. I've got a self-written MTA that supports any recipient prefixes on emails that are sent to @domain.com. It then firstly checks the RCPT TO: address (the _real_ TO address) against the email aliases assigned to all my users in the Active Directory/Exchange Server. Once that check is passed, it then runs the email through some custom blacklisting rules, and then finally runs the email through SpamAssassin. If the email gets past that, then it gets delivered into the users inbox. In Active Directory, the proxyAddresses attribute is used to stack up custom <something>@domain.com addresses for each user, which allows for many aliases per inbox. It does require management on the users part - they have to add an alias if want to use it, but that's done via a webform, so easy to do. Likewise they can yank an alias if it's been leaked and gets abused. This solution has been running for over 5 years now, and it works very very well. The only downside is having to manually add new custom blacklist rules due to the adaptive nature of the spammers.
- GigabyteCoin 10y ago>The only downside is having to manually add new custom blacklist rules due to the adaptive nature of the spammers. I wouldn't really call that a downside until AI is here. Impressive work!
- gradschool 10y agoI'm thinking of doing something similar and hope to learn from your experience. I have two questions. (1) Was it easier to write your own MTA than to use the milter interface to Postfix or other mature MTAs that support it? (2) How would you set up the MUA to use the right alias in the return address when users reply to a message instead of leaking their real email address? (e.g., Would you need another lookup table somewhere that maps (user,recipient) pairs to user aliases?)
- JackPoach 10y agoInteresting concept. There have been a number of times when 10 minutes that others typically give hasn't been enough for me.
- alanh 10y agoLove the anecdotes at the bottom. I’ll add two of my own: - Sent myself a photo from a Southern Californian theme park that starts with "D" and ends with a fireworks show, using a custom email address: No third-party spam, but my god their "unsubscribe" links (NOT that I ever subscribed) just don’t work, I got a promotion for everything vaguely Disney-related for a year until I blocked the address completely. Whoops, gave this one away! - Signed up for a famous freemium file-syncing service whose name also starts with "D" using a custom email address, never used for anything else; that ended up in the hands of spammers.
- Jaruzel 10y ago> Signed up for a famous freemium file-syncing service whose name also starts with "D" using a custom email address, never used for anything else; that ended up in the hands of spammers. Wasn't just me then. I /know/ I never used that particular address for anything else as it was specific to the D___Box service. Yet within 2 months, started getting lots of spam on it. I don't recall that company getting data breached, so totally unclear how that happened.
- alanh 10y agoI’ve been working on the assumption that a massive breach did happen, but was never announced (perhaps not even discovered internally).
- trickster_ 10y agoThe same happened to the address that I gave to the D-freemium file-syncing service... Never used that address anywhere else.
- homero 10y agoVery cool. Right now I'm using 33mail with a custom domain
- ricg 10y agoIs there a service that lets me send mail from such an email address as well? Let's say I use this for my Amazon account amzn.myusername@mailhero.io and I need to get in touch with Amazon customer support. For verification they require me to actually send an email from amzn.myusername@mailhero.io. Or another case: as soon as I have to actually send an email to a service I signed up for and use my real email address, that is then known to the service and could potentially be leaked.
- trickster_ 10y agoI am going to add that functionality soon. You will, of course, have to click the recaptcha for each message send... I hope everybody understands why. :)
- pulkitanand 10y agoYou could use gmail to send email from these addresses. Gmail requires you to verify that you own the email ids, which should be possible to do with the way mailhero works.
- KJP191 10y agoSounds like an effective (if slightly underhand) way to monetize. If paying up is the only way to retrieve an account someone cares about...
- ryandetzel 10y agoGreat idea but what happens when the site runs out of funds and shuts down? Now you have all of your email bouncing and no way to know and/or fix it easily?
- trickster_ 10y agoI can recommend reading the About-page...! https://mailhero.io/about https://mailhero.io/about
- nmalaguti 10y agoI used to use a service like this called endjunk.com. A few years ago it shut down without warning and I found I couldn't receive emails or update my username for several services. I tried rolling my own for a while, but it was painful to make sure my mail server was always up to date and patched. I also had issues with forwarded mail being marked as spam by my email provider. If this service becomes popular and starts forwarding lots of spam, it can result in the entire domain being blacklisted, especially since users never send replies to these addresses. Don't rely on free mail services to get mail you might care about some day.
- alanh 10y agoYep. Well, that’s why I feel pretty good about using my own domains + Fastmail!
- DanitaBaires 10y agoI do this using two Gmail adresses one set up to forward to another with filters.
- sacul 10y agoA feature like this is automatically baked in to my Fastmail account. "myemail@mydomain.com" can become "banks@myemail.mydomain.com", and all that email automatically goes to a folder called "banks". https://www.fastmail.com/help/receive/addressing.html https://www.fastmail.com/help/receive/addressing.html
- asjfkdlf 10y agoYou can do it with google apps too, but it's a little more difficult. Login into an account and setup an alias. There is a limit to the number of aliases, but you can just create more accounts with aliases that forward to your email.
- twhb 10y agoTwo concerns: What about 33Mail? Is this not the same thing with the tag shifted? What if this becomes popular? Spammers can write a special case for @mailhero.io addresses that strips or changes the prefix. If you block those avenues, it just turns into a much easier password guessing game: the user has dozens of passwords, and they're all one common word, lowercase.
- sanity31415 10y agoVery similar to http://33mail.com/ http://33mail.com/, which has been around for over 5 years.