4 ms·

> If I sign up for Walmart with `walmart@danshumway.com`, I haven't gained any privacy. If I sign up with `walmart@fastmail.com`, I've gained a great deal of pr

> If I sign up for Walmart with `walmart@danshumway.com`, I haven't gained any privacy. If I sign up with `walmart@fastmail.com`, I've gained a great deal of privacy. Depends on your thread model imo. Is it obvious to a human that "@danshumway.com" points to you? Yeah. Has anyone at walmart done the work to teach the computer about this? Probably not.

danShumway 7y ago
I suspect you're correct right now, but people used to say the same thing about Gmail `+` addresses, and I believe some marketers have gotten smart enough to strip those. Putting together a regex expression to strip out the domain and check to see if it's unique across a shared database of email addresses would be really easy, so I wouldn't count on this being ignored forever. I'm a pretty boring person, so aside from general paranoia around keeping infrastructure secret I'm not particularly concerned with anyone finding out what accounts I have online. But, depending on your situation, it might also be prudent to include database leaks in that threat model as well, which are likely going to be searched through by actual humans.
- masukomi 7y ago
  to be clear "+" addresses aren't a Gmail thing. they work on all mail servers. they're part of the spec for how you define an email address. Any server that doesn't support them is, by definition, broken. http://www.faqs.org/rfcs/rfc2822.html http://www.faqs.org/rfcs/rfc2822.html
  - eitland 7y ago
    > they work on all mail servers. Wrong AFAIK. Unless certain mail providers have been patched recently without me noticing. > they're part of the spec for how you define an email address. Any server that doesn't support them is, by definition, broken. Might very well be true, I haven't checked. In that case I guess a number of people get their mail from broken mail servers so they have to deal with it anyway.

danShumway 7y ago

I suspect you're correct right now, but people used to say the same thing about Gmail `+` addresses, and I believe some marketers have gotten smart enough to strip those. Putting together a regex expression to strip out the domain and check to see if it's unique across a shared database of email addresses would be really easy, so I wouldn't count on this being ignored forever. I'm a pretty boring person, so aside from general paranoia around keeping infrastructure secret I'm not particularly concerned with anyone finding out what accounts I have online. But, depending on your situation, it might also be prudent to include database leaks in that threat model as well, which are likely going to be searched through by actual humans.

masukomi 7y ago
to be clear "+" addresses aren't a Gmail thing. they work on all mail servers. they're part of the spec for how you define an email address. Any server that doesn't support them is, by definition, broken. http://www.faqs.org/rfcs/rfc2822.html http://www.faqs.org/rfcs/rfc2822.html
- eitland 7y ago
  > they work on all mail servers. Wrong AFAIK. Unless certain mail providers have been patched recently without me noticing. > they're part of the spec for how you define an email address. Any server that doesn't support them is, by definition, broken. Might very well be true, I haven't checked. In that case I guess a number of people get their mail from broken mail servers so they have to deal with it anyway.