5 ms·

Good idea on (2). I have a gmail account, so I just use myaccount+whatever_service@gmail.com. Pretty handy.

tonmoy 10y ago
If a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain
- ethbro 10y ago
  Same argument for port knocking. Absolutely ineffective against targeted attacks, but most attacks aren't customized and targeted.
  - EdHominem 10y ago
    It also cuts down on the attack surface enough to let you use more active alerting.
- rzzzt 10y ago
  "service1" could be generated randomly as well, and stored along with the password in a password manager. Another nice property of this suffix is that one can identify who gave away their email address / which site it was scraped from when receiving spam; not sure where I have seen this written down originally.
  - drdaeman 10y ago
    I think when spammers see a "+" they just strip everything after it down, i.e. me+spam@example.org -> me@example.org. Not to say many sites just don't accept "+" (or, worse, cease to accept such addresses). Unique, non-guessable, machine-generated addresses are the way to go (do with emails just like password managers do with passwords), but no common person can use those, because they'll need a domain and self-hosted MDA. E.g. $ echo "$(echo -en "secretsalt\nsome.example.net" | sha1sum -b | xxd -r -p | base36 | cut -c-8)@me.example.org" h6t8490d@me.example.org Or just generating random IDs and maintaining the database. (Sure, HMAC would be a better idea than this string concatenation, but meh...)
  - tonmoy 10y ago
    Then I could just make my rand(service1) chars larger. No point in adding it to email address at all. Email leak (privacy) is an issue that this could help with but I do not see any benefit in terms of securing my account
lukasm 10y ago
How do you generate new emails? Say, I see a new websites I need a new email? What do you do? Is there a chrome extension that can do it with one click?
- StavrosK 10y ago
  I use 33mail.com. You just give them a new email address, no need to generate. For example, hackernews@lukasm.33mail.com
- robotmlg 10y ago
  Gmail doesn't need any config. Add whatever you want to your usual email after a + and it'll just work
  - lukasm 10y ago
    Yeah but doesn't prevent the attack. Username is still in the email address. Ideally I'd like <domain>+<nonce>@gmail.com that forwards all to my email.
- stephengillie 10y ago
  My personal domain is set to forward all email to my Gmail. Since Google is my registrar, it's expectedly simple to configure this. I haven't setup outbound addresses; services rarely need email sent to them, and replying from my Gmail hasn't caused me any problems yet.

If a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain

ethbro 10y ago
Same argument for port knocking. Absolutely ineffective against targeted attacks, but most attacks aren't customized and targeted.
- EdHominem 10y ago
  It also cuts down on the attack surface enough to let you use more active alerting.
rzzzt 10y ago
"service1" could be generated randomly as well, and stored along with the password in a password manager. Another nice property of this suffix is that one can identify who gave away their email address / which site it was scraped from when receiving spam; not sure where I have seen this written down originally.
- drdaeman 10y ago
  I think when spammers see a "+" they just strip everything after it down, i.e. me+spam@example.org -> me@example.org. Not to say many sites just don't accept "+" (or, worse, cease to accept such addresses). Unique, non-guessable, machine-generated addresses are the way to go (do with emails just like password managers do with passwords), but no common person can use those, because they'll need a domain and self-hosted MDA. E.g. $ echo "$(echo -en "secretsalt\nsome.example.net" | sha1sum -b | xxd -r -p | base36 | cut -c-8)@me.example.org" h6t8490d@me.example.org Or just generating random IDs and maintaining the database. (Sure, HMAC would be a better idea than this string concatenation, but meh...)
- tonmoy 10y ago
  Then I could just make my rand(service1) chars larger. No point in adding it to email address at all. Email leak (privacy) is an issue that this could help with but I do not see any benefit in terms of securing my account

lukasm 10y ago

How do you generate new emails? Say, I see a new websites I need a new email? What do you do? Is there a chrome extension that can do it with one click?

StavrosK 10y ago
I use 33mail.com. You just give them a new email address, no need to generate. For example, hackernews@lukasm.33mail.com
robotmlg 10y ago
Gmail doesn't need any config. Add whatever you want to your usual email after a + and it'll just work
- lukasm 10y ago
  Yeah but doesn't prevent the attack. Username is still in the email address. Ideally I'd like <domain>+<nonce>@gmail.com that forwards all to my email.
stephengillie 10y ago
My personal domain is set to forward all email to my Gmail. Since Google is my registrar, it's expectedly simple to configure this. I haven't setup outbound addresses; services rarely need email sent to them, and replying from my Gmail hasn't caused me any problems yet.