7 ms·
> I want to know who betrayed me. You can run your own email server (or have a company host a private domain for you), set up a catch-all address that only you
by sleavey 7y ago
> I want to know who betrayed me.
You can run your own email server (or have a company host a private domain for you), set up a catch-all address that only you know, then use a different email address for every site you sign up to. That way you can find out this sort of information.
Using this technique, I know for example that spammers obtained the address I signed up to Stack Overflow with. The email is not shown on my profile now, and I can't rule out that it wasn't ever shown publicly, but evidence suggests they sold my address to spammers. I also know that spammers crawled my website and found a blog post where I stupidly made up a random address using my domain as part of an example for configuring junk filters (the irony is not lost on me).
- bennylope 7y agoI do this with Fastmail, including specialized subdomains to help me segment the addresses and then distinct email names for each sign up as necessary. You can also do something similar with Gmail (and probably other providers) using "+" in your username, e.g. "myname+hackernews@gmail.com". This creates a unique email address that delivers to your Gmail account as if the "+<whatever>" were absent. This is more easily defeated if you're a moderately motivated spammer.
- kps 7y agoIf you run your own email, you can catch the moderately motivated spammer: use a character other than + as the segmenter, and a honeypot +. <me+some-thing@example.com> <me+some-other@example.com> Here, ‘-’ is the segment character, <me+some@example.com> is the actual delivery address, and <me@example.com> triggers an immediate block.
- mehrdadn 7y ago> <me@example.com> triggers an immediate block. This doesn't work. I've seen legitimate companies just strip everything from the + onwards.
- TeMPOraL 7y agoWell, "legitimate". There's no legitimate reason for a company to remove anything from user-provided e-mail address.
- mehrdadn 7y agoLegitimate reason != legitimate company
- TeMPOraL 7y agoDoing something like this is extra work, implying the company in question has either some malicious intent (e.g. spamming, or sharing data with third parties behind users' backs), misguided (e.g. thinking this is a proper way of dealing with user account spam), or just don't give a damn. Either one of these cases reflects badly on such company.
- mehrdadn 7y agoYou can reflect it however badly you want, I'm just saying these weren't companies most people would consider shady or cutoff business with over this issue.
- h1d 7y agoUsing + isn't the best method as some services just won't allow having + sign in the email address (probably shitty email address detection) and of course spammers can simply strip the alias parts and send you mail. You'd have a better luck with *@user.your.domain if you can give each user a unique domain.
- ghostbrainalpha 7y agoAre you suggesting buying a new domain for each email address? That could get extremely expensive to maintain. I bought a single domain @MyEmail.org, and create a new user for each site I sign up with that forwards to my gmail. 1@MyEmail.org, 2@MyEmail.org, 3@MyEmail.org etc...
- h1d 7y agoNo. Your case works for a single person but for more people on a single domain, you would want to do, service1@me.your.domain service1@dad.your.domain (Instead of me+service1@your.domain) service2@me.your.domain service2@mom.your.domain and so on. So, those services have no way of fooling you by tampering with the alias parts. But of course this isn't easy unless you roll your own mail server.
- ghostbrainalpha 7y agoThanks for the breakdown. I didn't think about using Sub Domains!
- StavrosK 7y agoFastmail supports this natively (and is awesome). You can do service@user.yourdomain.com and it will get delivered to user+service@yourdomain.com.
- 27182818284 7y agoYou can use the + trick and . trick with Gmail addresses too. I think Outlook as well supports the + trick. The only downside to this is that there are plenty of sites that don't accept a + either knowingly or unknowingly.
- kepikoi 7y agogmail's +suffix is a great built-in tool to achieve this. E.g. me@gmail.com and me+stackoverflow@gmail.com route to the same destination. Sadly I've seen services that do not accept pluses in a email address
- cptskippy 7y agoThis is what I've done for close to 15 years and I'm generally surprised by how few of my address have been leaked.
- 3martron 7y agoI believe they were breached relatively recently. If your jurisdiction doesn't require reporting you might not have gotten notification currently or in the past. They may also not know they're breached. Reach out to support.
- looeee 7y agoYou can also do this with a single email address and the + symbol: jimmy+facebook@gmail.com jimmy+twitter@gmail.com jimmy+hackernews@gmail.com all go to jimmy@gmail.com
- nimajneb 7y agoDoes a . works as well doesn't it? I can't remember if it gets stripped out or not if the email server isn't expecting it.
- swiftcoder 7y agoGmail explicitly ignores '.' in email addresses. I don't think it's standard behaviour across other email systems, though, and even gmail didn't always ignore it.
- mikedelfino 7y agoI used this technique a few times until I realized that spammers and, most importantly, companies that sell their user databases also know about it. So it's actually pretty trivial for them to strip the +something bit before any shady business. Now I don't really care anymore. Most spam are catch automatically anyway. Even when they're not, it's actually a tiny annoyance to me. And what am I going to do if I know for sure that some company sold my data? Sue them? I will most certainly not.
- koide 7y agoYou can't rule out that it wasn't publicly shown but you say that "evidence suggests" that they sold your address to spammers. Do you have any evidence at all?