27 ms·

Disposable, anonymous email forwarding is a massive step forward for privacy. I know we've all been doing it for a while, but this on a consumer level is fantas

• pmart123 7y ago
  I wonder how many poorly designed database schemas this will break that used email as a primary key/id.
  • saagarjha 7y ago
    I think the email is consistent for each app, so there should only be a problem if the user wants to change their email, right? Plus, apps would have to opt-in to support this.
  • not_kurt_godel 7y ago
    Why would this break any databases? Accounts will still have valid emails. The difference is just that there won't be data for that email in third-party tracking databases, which is a good thing.
  • dmix 7y ago
    I don't think you'll find much sympathy for someone who's software would break on such a change. That sounds broken already.
    • beat 7y ago
      Yeah, it doesn't break anything. It just reveals that it was already broken.
• albertgoeswoof 7y ago
  If you don’t use apple, I just built this as a stand-alone product: https://idbloc.co https://idbloc.co
  • nextos 7y ago
    There is also spamgourmet, which is free and has been around for 20 years.
    • albertgoeswoof 7y ago
      Unfortunately they’re not accepting new signups
      • dvtrn 7y ago
        Is there by chance a Firefox add-on on your product roadmap? This looks interesting
        • albertgoeswoof 7y ago
          Thanks! It’s already available as a Firefox and chrome add on: https://addons.mozilla.org/en-GB/firefox/addon/idbloc/ https://addons.mozilla.org/en-GB/firefox/addon/idbloc/ https://chrome.google.com/webstore/detail/idbloc-secure-and-unique/jhjhmcgfjgfnbolmedfhbbjeidjpmajl?hl=en https://chrome.google.com/webstore/detail/idbloc-secure-and-...
      • nextos 7y ago
        Oh, I hadn't noticed. Your service looks nice, and if spamgourmet is not taking new signups it does make even more sense.
  • bglusman 7y ago
    This looks a lot like 33mail (https://33mail.com/ https://33mail.com/) which I've been using pretty happily for 4-5 years now (and paying I think $10-15 a year for, so a lot less than this on a per month basis, but they're not strictly unlimited)
    • albertgoeswoof 7y ago
      33mail is cool but the domain being the same & unique for each user removes the privacy element, and it asks users to make up their own addresses (and remember them), which can be dangerous. For example you might create facebook@dave.33mail.com, so it’s very easy to guess what Dave’s twitter login is or other target. With Idbloc (and apple sign in) the address is completely random and untraceable, and it’s impossible to tell which addresses belong to which users.
• snarf21 7y ago
  I agree that it is great. I'm not sure how we convince people to not signup on sites that don't offer this SSO option. I've always struggled with the question of 'How do we convince people to care about privacy when they post their location and meal to a public social media every hour?'.
  • hprotagonist 7y ago
    My rule, and it is a semi-idiotic one, is "i don't impulse buy from independent merchant websites that don't support apple pay at checkout". I usually email them after, too. "I actually clicked through your instagram ad, looked at some clothes that looked nice, and didn't buy anything because I was on my phone and didn't want to make a new account and add credentials to my password manager. Have you considered adding apple pay support to your shopify account?" I have no idea if i'm helping or not.
    • reaperducer 7y ago
      It's dumb that so many sites require you to create an account just to buy something from them. One of the reasons I get lunch from Panera and Pei Wei is because I can check out on my phone as a guest when I order ahead. Heck, even fleaBay lets you do a guest check out now. That was what made me consider using it again.
    • bscphil 7y ago
      I think it's not an idiotic idea, it's just that your idea of what counts as third-party payment support is a single smaller payment provider located mainly in the United States. I follow a similar policy, but in my case the third-party payment services are Paypal, Stripe, and Coinbase, all of which are reliable and don't require me to give financial data to the seller. Paypal seems to be near-universally supported on small ecommerce sites.
      • oefrha 7y ago
        Note that PayPal gives away your email address, and I’m not a fan of that. If a third party wants my email address, they should ask me directly (and I’ll give them a unique one); PayPal shouldn’t distribute my email address for me. Look, I use three email domains for online accounts, in addition to a unique address for each account — one domain that links to my actual identity (my public-facing, professional domain), one domain that’s somewhat anonymous, and one domain reserved for highly sensitive accounts, e.g. online banking, PayPal, AppleID, etc. And PayPal sharing my email address with third parties breaks the model, making my sensitive domain less secure.
• anbop 7y ago
  And being done by Apple, most services can’t just reject these the way they do with Mailinator addresses, since it would be throwing away a giant chunk of their revenue. Apps with huge consumer demand like Uber or Facebook could get away with it, but not the vast majority of apps.
  • jiveturkey 7y ago
    I think this will be proven wrong. Do you think that the folks using Mailinator are strictly non-Apple users? As an Apple user that signs up with a mailinator ID, if rejected I either move on or use a more palatable address, as the case may be depending on my desire to use that service. The same will hold true for any private appleid address.
    • untog 7y ago
      You're missing the scale. Mailinator users are a very small percentage of users, while Apple Sign In users are likely to represent a much larger slice of your potential users, given that you have a honking great button there waiting for them.
    • anbop 7y ago
      I’d say that one month from release, 100 times as many people will know about Sign in With Apple as have ever used Mailinator. And Apple marketing will drill into them why they should use it, and mark apps in the App Store that support it. Eventually for experimental apps that they are not 100% decided on getting, there will be a large fraction of users who simply won’t try an app that doesn’t support it.
    • dan-robertson 7y ago
      I think there are two differences here: 1. Services have little incentive to support mailinator, and indeed may deliberately choose not to if they feel it is leading to signups they don’t like. On the other hand it would be hard to argue with an incentive like the App Store requiring you to support apple’s service. 2. Because the service is built in to apple’s systems there seems to be an implicit contract that apple wont let it be abused for the purposes that many sites claim mailinator is used for (because it isn’t useful to apple customers if sites don’t trust it and it). So they might be more willing to accept these email addresses. I guess neither of these help services like mailinator gain credibility.
• taytus 7y ago
  My first thought was: Bye bye mailinator.com
  • throaway5533 7y ago
    I use mailinator to have some privacy from my email provider.
  • jacquesm 7y ago
    As if everybody uses Apple.
    • taytus 7y ago
      what is the need to have such a knee jerk reply? Seriously, why would you say something like that? My comment meant: "Bye bye " for me. As in: I'm not using it anymore. I don't get you man.
      • Permagate 7y ago
        I'm not the commenter. But taken at face value, your comment could be either bye bye mailinator.com (I'm not using you anymore) or bye bye mailinator.com (no one is going to use you anymore). Fwiw, I thought you meant the latter until I read your reply.
        • taytus 7y ago
          Thank you. I can see that. But if anyone really is curious about the meaning and needs clarification, I believe it’s best to ask.
          • throaway5533 7y ago
            I would have never thought you meant the former. I believe it’s better to be more clear and evident in your writing.
• nothrabannosir 7y ago
  In case anyone needs something similar today: Outlook already allows you to create ephemeral top-level aliases, i.e. XXXX@outlook.com. You can use this to sign up, then delete the alias. It can't be traced back to your account and nobody blocks @outlook.com. https://account.live.com/names/Manage https://account.live.com/names/Manage (not to take away from this announcement at all; just to provide some context. it's an often overlooked feature which people here might appreciate.)
  • throaway5533 7y ago
    I switched to Outlook because of this. I also like how you can set it so only a specific email can login. That way if your alias is compromised, your account won’t be.
  • ocdtrekkie 7y ago
    Microsoft's email management has some neat perks here: You can change which one's the primary as well. It's entirely possible for you to change the email address of your Microsoft account, by adding an alias, making it primary, and then deleting the original. In fairness, there are some quirks with this, my old email address would still get sent some receipts or some newsletters because the configuration for service A, B, or C was buried somewhere else in the account. But generally speaking, it works pretty well. As someone who changed their name but had to keep their Google account with the old one because of how much Google account data/purchases can't be moved to a new account, this felt positively revolutionary. Google accounts can only have one Gmail address for their entire lifetime.
  • iwasakabukiman 7y ago
    Apple also lets you do this with your Me/iCloud address as well.
  • basch 7y ago
    I dont think thats quite the same thing as an Identity Service, its just a component. In Microsoft's world im either using my Microsoft Account to sign in OR using throwaway email addresses, not both. . Apple can get way ahead of the competition by combining about 3 things. 1) Ephemeral email addresses 2) OAuth or apples equivalent tokens 3) Keychain autogenerate and auto-populate If all those products are integrated correctly, this becomes the SINGLE sign on of single sign ons. If a service supports Apple OAuth, your name is hidden, and you only have one Apple password to remember. If the service doesnt support Apple Tokens, then apple fills in a private email address and a random password, and abstracts away the fact that the service doesnt support Apple Tokens. The user experience is nearly the same regardless. Tokens and randomly generated passwords should be managed from the same interface, allowing you to either revoke access (token) or cycle the key (both.) I've felt it for a while, but the banking industry needs to arrive at something similar. Chase, BoA, WF, and Citi should turn Zelle into a banking OAuth Identity Service.
• Pym 7y ago
  I've been trying for some time to explain to my friends and family how a unique email/password + 2FA strategy is the best thing to do and how it would allow them to cut one in case it gets leaked. I guess I will just tell everybody about "Sign in with Apple" now, it will be easier.
  • damnyou 7y ago
    Will you also tell that to your Android or Windows using friends?
    • aendruk 7y ago
      You can tell them it's a valuable category of service that they should want an analog of.
    • Pym 7y ago
      Family is easy, I made them switch to Apple years ago and things have been a breeze since. Most of my friends using Android are also working in IT and are already using disposable/forwarding emails AFAIK. And... to be honest, I don't have friends using Windows :D
  • notlukesky 7y ago
    Take a look at SAASPASS Authenticator & Password Manager. It might meet your criteria of usability and security.
    • eropple 7y ago
      It's only polite to disclose that it's your company when you flog it like that.
• buildbuildbuild 7y ago
  They also have pretty strict whitelisting requirements around who can send emails to these privacy addresses. "In order to send email messages through the relay service to the users’ personal inboxes, you will need to register your outbound email domains. All registered domains must create Sender Policy Framework (SPF) DNS TXT records in order to transit Apple's private mail relay. You can register up to 10 domains and communication emails." https://help.apple.com/developer-account/#/devf822fb8fc https://help.apple.com/developer-account/#/devf822fb8fc
  • moduspol 7y ago
    Neat. It sounds like this extra step prevents a situation where, for example, a dev's server-side database gets hacked and the users' relay e-mail addresses are exposed. The attacker wouldn't even be able to send e-mail messages to the users. He'd also need to compromise the registered domain's mailservers, or their DNS servers (to modify the SPF records), or their Apple dev account to add their own registered domain.
    • deleted 7y ago
      [deleted]
• aasasd 7y ago
  I was wondering why all the popular ‘private’ email services don't seem to have such a feature.
• ljm 7y ago
  Apple is evolving and adapting in a way the rest of the industry can’t follow. And, they have the money to do it. For as long as Android has google ownership... they will never, ever be able to compete on the level of privacy that Apple is now buying into.
• codezero 7y ago
  Totally agree. I set this up for myself to have a anything@mytrowawaydomain.com and it's great to see when folks sell your email :) So far it's only happened once, actually, when Keen.io got bought by a PE firm, I got a bunch of spam, so they clearly sold off my email address. It's a system that would be hard to operate as a "normal" person, so this is a great step.
  • josephwegner 7y ago
    As a former (pre-sale) Keen employee, this makes me sad. I'm very sorry.
    • codezero 7y ago
      No worries. I am at least glad the product is still alive. Despite being a competitor, there is a lot to admire about the offering. I am really bummed it didn't come out ahead of other competitors :)
• kukabynd 7y ago
  Agreed, I think it’s the most important part of the demo today.