10 ms·
I solve the spam problem by having my own domain with an infinite number of email addresses. Whenever I sign up for something I use $PERMUTE@mydomain.com, where
by dreamcompiler 6y ago
I solve the spam problem by having my own domain with an infinite number of email addresses. Whenever I sign up for something I use $PERMUTE@mydomain.com, where PERMUTE is some easily-reversible permutation of the vendor's own name.
This has two benefits: I can easily route/filter incoming email from that vendor, and if I ever receive spam at that address I know which vendor sold my info.
- todd3834 6y agoI do this as well using a not so well know trick that exists on most major email providers including gmail and iCloud: myemail+permute@icloud.com. Those emails will arrive at myemail@icloud.com
- layoutIfNeeded 6y agoThis won't help you tracking down which service leaked your e-mail address, because the first thing spammers do is trimming the +suffix.
- therein 6y agoThat is unless the spammer was clever to do the following: providersWithSuffixSupport = ["icloud.com", "gmail.com", "googlemail.com", ...]; if email.endsWithAnyOf(providersWithSuffixSupport) { email = email.trimBetweenFirstOccurrence("+", "@"); }
- ryantgtg 6y agoI have a site with users, and while we have no interest in selling their addresses, it still strikes me as futile when people add "+mysite" to their address. It would take me 2 seconds in excel to zap all those appendages.
- tastroder 6y agoNot everybody uses the scheme for some futile security purpose, some sites are just a bit annoying with their outgoing addresses with their non-nefarious communication and the + scheme can be a nice way for rules.
- ryantgtg 6y agoI hadn't thought of that case. I've always had good luck simple simple rules like, "if @theirsite.com then move to folder".
- quotz 6y agoHow did you do this?
- stagas 6y agoAny specific vendors we should be aware of? :)
- glitchc 6y agoCan you do this without running your own email server? If buying email service from a vendor, costs are usually per user (per address).
- mstade 6y agoI do this with FastMail aliases, works great!
- glitchc 6y agoAhh aliases. Still show up in the main account though. I guess they can be filtered as spam.
- the_pwner224 6y agoFastmail also has a catch all / wildcard option which I am using. You don't need to create aliases for every email; instead any email to *@mydomain.com goes to my single email inbox. And similarly I can send from anything@mydomain.com.
- jabroni_salad 6y agoI use a subdomain for it. Anything to that subdomain is marked as read and filed in the "spam-adjacent" folder. I'll look in there for transactional stuff and marketing bs never increments my unread counter. Only real people appear in my actual inbox and it's basically email nirvana.
- mstade 6y agoThe way I do it is I use a subdomain for any aliased email, e.g. vendor.com@account.mydomain.com and then I just have rules to move anything sent to account.mydomain.com to a separate folder, then it never shows up in the main mailbox unless I put it there myself. Works fine!
- MagnumPIG 6y agoI do it with the free email address that comes with my domain name. In this case I'm using gandi.net but I'm sure most domain name providers have a similar deal.
- jimmaswell 6y agoI've seen a lot of people doing this. Maybe we should have a public database of what company sold emails to who that everyone who did this can contribute to, with some kind of proof required.
- dreamcompiler 6y agoDifficulty there is that many vendors are victims of data breaches, so they perhaps don't deserve to be demonized quite as much as if they'd outright sold the data. Could be difficult to prove which side of Hanlon's Razor they fall on.
- oddlama 6y agoIf a company has a data breach, they most likely still have a security problem. While they may actually be victims if any 3d party software is exploited, it still comes down to system misconfiguration inany cases. And that would still be their fault.
- anthony_r 6y agoThat would be fair, but frankly as a user that gets the spam - I don't care. The damage to me is pretty much the same. It would be important to stress it out on the page that it may be due to security negligence/failure rather that just data sale.
- jbverschoor 6y agoAs a matter of fact.. they lost or gave away your info. They should reimburse you for that. I’m working on something I call “datapoint tax” Make this hoarding of data a (tax) liability. A policy like this will solve most problems.
- yorwba 6y agoThat should depend on whether they informed the affected customers that their data was leaked in a breach or (if they weren't yet aware of the breach) how they react to the news that they have been breached.
- athenot 6y agoI do the same and in addition to reselling of personal information, it also shows when there was a data breach, as a whole bunch of spam starts pouring in the ones that are breached. Sometimes before an official announcement is made as the case was with Adobe.
- linsomniac 6y agoI used to do this, and recall one particularly irate call from someone asking "why is my company name in your e-mail address!?!" They seemed to be concerned that I was impersonating them.
- dreamcompiler 6y agoThat's why I permute it, so it's not so blatantly obvious. OTOH most email signup handlers are robots nowadays and no real human ever pays much attention to them, so it hasn't really been a problem for me.
- dlandau 6y agoI do the same, but just use the vendors name as is.
- anonymousiam 6y agoI do it too. I've found some vendors that will not allow their company name in the email address. For example, samsung@mydomain.com cannot be used to register with any Samsung-operated service.
- OJFord 6y agoI do it too. I had one phone me, deeply suspicious, and demanding to know how their 'domain' came to be in my email address! I thought it was an interesting blend of technical literacy both to notice and be bothered by that!
- captn3m0 6y agoMy fav bypass was using a string reversal on the company name.
- randyrand 6y agoWhat percentage of companies sell your info?
- deepspace 6y agoI will answer, since I have been following this strategy for almost 20 years. In my experience, very, very few companies sell email addresses. Maybe 1% or fewer. The vast majority of spam tied to company-specific addresses is the result of data breaches. I get spam to my (old) linkedin, dropbox, equifax addresses - all starting after they were hacked.
- leephillips 6y agoI do this too, and this is also my experience. In fact, at first I expected my ad-hoc email addresses to be the target of a good amount of spam, but I was surprised to find this almost never happens.
- TeMPOraL 6y agoI have to concur. The spam I'm getting only comes to aliases I published on some public-facing site. So I get a lot of spam for fb@, and hn_work@ (used in "Who wants to be hired?" posts), but surprisingly not hn@ (which is in my profile) or hello@ (used on my website). I don't think I got spam for any alias I used only to register an account with some vendor.
- joekrill 6y agoI did this for a while. I gave up because it just wasn't worth the effort. I would run into exceptions to my permutation rule maybe. Or I signed up for an account and forgot which email I used so couldn't reset the password. Things like that. > This has two benefits: I can easily route/filter incoming email from that vendor, and if I ever receive spam at that address I know which vendor sold my info. There's just nothing actionable to do with this information. OK, so I caught badcompany.com giving my email address to marketingfirm.com. But the damage is already done. Sure, I can send them a nasty email, but it'll just get ignored or whatever.
- bradstewart 6y agoI just started generating random addresses and putting them in password manager. The actionable bit is permanently black-holing all incoming mail to that address if/when I no longer need the service, or the "spam" rate gets too high.
- joekrill 6y agoI use gmail, so I just use the "Report as spam" option. I'm assuming Google uses that information in some way when calculating spam scores. So if enough people do the same, those emails will just start getting sent to spam automatically for huge amounts of people, and therefore punishing those folks for doing it in the first place. That seems more effective to me. And I just never really had that big of an issue with spam where I needed to black-hole a specific email address. So for me it just wasn't worth the effort.
- rootlocus 6y agoPeople using "report as spam" is what made gmail such a great spam filter. Is also the reason google has such high market share of public email addresses. It's also why people running their own mail servers are afraid of being blacklisted by google.
- newsbinator 6y agoYesterday I used the report as spam feature on an email from Microsoft. The footer had no unsubscribe option and the "manage communication preferences" requires a login/password combo that I couldn't be bothered to reset for my new geolocation. I doubt this'll make a dent in Microsoft.com's spam score.
- zzo38computer 6y agoI do pretty much the same thing. Although I don't do a lot of email sign up stuff anyways.
- osamagirl69 6y agoI do this using a catchall account with Fastmail, but I don't even bother obfuscating the vendor name. Occasionally they don't let you use an email with their name in it, which which case I add 'isdumb' to their domain and then use it. It happens occasionally that they get confused, but so far I haven't run into any issues. I do agree in principal that it would be better to have some sort of hash that maps their domain to the e-mail in a way that is easy for me to know but hard for someone else to figure out. Ideally in a way that is still reasonably easy to pronounce over the phone. What would be really slick is to have such functionality integrated into a password manager.
- gregmac 6y agoAlso do this, with two variations: 1. Use a catch all alias (zero-effort) 2. Just use the domain or in some cases company name 3. Use a sub-domain The sub-domain is essential for catch-all, otherwise you get a crazy amount of spam. I forward it all to a single Gmail address, have a rule to move it to a specific folder (based on "to" address), and otherwise let Gmail spam filtering do it's thing. I've been doing this since early 2000's, and had very few issues with using domain/company. One or two that dis-allowed it, a couple confused humans.
- ValentineC 6y ago> The sub-domain is essential for catch-all, otherwise you get a crazy amount of spam. Seconding this. I get a larger portion of targeted spam (addresses that I gave out in the past) with a sub-domain catch-all. At a normal second-level domain catch-all, I get more random spam addressed to common addresses like accounts@, billing@, and sales@.
- msravi 6y agoYahoo mail has a feature under Mailboxes, called "Disposable email address" that allows you to pretty much do the same. You choose a "base" name, and then you can create upto 500 disposable addresses of the form basename-keyword@yahoo.com - you can choose the "keyword" based on the site you're signing up for, the basename stays constant. All mails to the disposable address get delivered to your normal mailbox, but you can go and delete a disposable address or filter it to spam. Also, both the basename and keyword remain untraceable to your actual address (unlike gmail's + format that has your base email id embedded in it). I used to use this earlier, but then I couldn't find the setting easily on their mobile web interface and got tired of either switching to the desktop version or waiting to get to a desktop to complete a signup. Nowadays, I just report spam if there's no unsubscribe option.
- 14k12j41j211 6y agoI've been using me+company@mymail.com ever since. It works mostly except for the real bad websites that disallow plus signs. I got two mails telling me I cannot use the company name in my e-mail, they'd file for fraud if I would. (got resolved by explaining how e-mail works, but still)
- thefunnyman 6y agoThis is the easiest and most widely available solution imo. I use ProtonMail which allows for plus addressing. Gmail also offers this feature if I recall correctly.