14 ms·

Firefox Relay

352 points by charlieirish 6y ago

Bishonen88 6y ago
And what happens when FireFox decides to drop this option 1-2 years into the future? I reckon they'll give time to change the email address on all the pages one used it for, but still... nvm, it's in the FAQ: "What happens if Mozilla shuts down the Firefox Relay service? We will give you advance notice that you need to change the email address of any accounts that are using Relay aliases." Note that one cannot reply using this service (yet). So the whole anonymity is gone as soon as one wants to contact some service without disclosing the real address (?)
- maxrovertsb 6y ago
  It's nice that they are being transparent about it.
- m-p-3 6y ago
  > And what happens when FireFox decides to drop this option 1-2 years into the future? The same thing if any other company did it. That said, I do hope they'll offer an option to pay for more email relays which could also ensure its viability. Having 5 relays for free is nice, but I'd personally use a unique address per service.
- mk89 6y ago
  Just a proper email provider that offers this features. Fastmail, GMX, ...
- tyingq 6y ago
  I do miss Firefox Send.
  - decrypt 6y ago
    Same. I have been using Tresorit Send [1] and Visée's (developer of ffsend CLI tool) Firefox Send instance [2] in the meantime. Visée is also looking for donations [3] to support hosting of that instance. [1] https://send.tresorit.com https://send.tresorit.com [2] https://send.visee.com https://send.visee.com [3] https://gitlab.com/timvisee/ffsend/-/issues/100#note_376316378 https://gitlab.com/timvisee/ffsend/-/issues/100#note_3763163...
    - PufPufPuf 6y ago
      The correct URL for the Firefox Send instance is https://send.vis.ee/ https://send.vis.ee/
    - timvisee 6y ago
      Thanks for mentioning Send and ffsend! Yeah, the instance is available at: https://send.vis.ee/ https://send.vis.ee/
  - lights0123 6y ago
    https://news.ycombinator.com/item?id=25524472 https://news.ycombinator.com/item?id=25524472 is certainly not a complete replacement, but most of the time I used it locally so that would work.
  - Whitecoyote 6y ago
    I miss it too, it was so convenient. I use https://transfer.sh https://transfer.sh instead.
- eloisant 6y ago
  I'm probably going to use it for "throw-away" email. As in, I just need to receive a link right now so the service think they have my real address, after that the alias might as well be trashed. The only thing I'm worried is that this domain will soon be blacklisted by services (especially those I don't want to give my email address to).
  - josepmdc 6y ago
    For that use case you can just use a temporary email provider like temp-mail.org which are harder to blacklist since they have a lot of random domains.
    - SamuelAdams 6y ago
      Yep I often use "ten minute mail" for this too.
    - PufPufPuf 6y ago
      Firefox Relay seems easier to use, thanks to the one-click generated emails by the browser extension and the fact that the emails arrive in your actual inbox. But I agree that the domain is going to land on all the blacklists -- I hope they implement alternative domains for this reason.
- groovecoder 6y ago
  Howdy. I'm the tech lead on Relay. We're working on replies right now: https://github.com/mozilla/fx-private-relay/pull/770 https://github.com/mozilla/fx-private-relay/pull/770
  - lecarore 6y ago
    While you're here, can you test the relay dashboard (where you can create aliases) on Firefox for Android 84.1.4 ? The scroll is incredibly sluggish, I don't know what scroll effect you added but please have a look. It's a bit unfortunate for a Mozilla service ^^ I can provide you a screen capture if needed.
    - groovecoder 6y ago
      Can you file that here so I don't forget? https://github.com/mozilla/fx-private-relay https://github.com/mozilla/fx-private-relay
- megous 6y ago
  You usually don't need the address you registered some account with to change account email to something else. Services usually just verify you control the new email address.
- r2b2 6y ago
  Founder of Owl Mail [https://owlmail.io https://owlmail.io] here. It's easy for me to promise Owl Mail will not shut down without significant advanced notice (hopefully that never happens, but if it does I will provide a clear transition plan for all users). As a token of confidence, I've moved all ~150 of my online accounts (including all banking, financial, and healthcare accounts) to Owl Mail – it needs to exist for my life to operate smoothly.
  - neogodless 6y ago
    From your home page I get the impression you only support having generated @owlmail.io email addresses. Is that accurate? Does your system track which online service gets which email, or do you track that yourself in a password manager?
    - r2b2 6y ago
      1. Yes, only @owlmail.io domains for now. But, Owl Mail will allow for custom domains soon. 2. An upcoming feature will enable the creation of sender 'allow' and 'deny' lists for each Owl Mail address (With default sender 'allow' lists for top sites). Currently I track my account credentials in a password manager. A browser extension is also on Owl Mail's roadmap.
allendoerfer 6y ago
Will be added to the list of domains people cannot use to sign up for accounts. In my experience, this only works on small sites.
- cmeacham98 6y ago
  In my experience it is the other way around. Big name websites generally have enough users that email "just works". Smaller websites are more likely to use misguided measures such as a bad email validating regex (hello to anyone with a non-standard TLD!), only allowing gmail, or blacklisting domains like these.
  - lxgr 6y ago
    +1, and ironically I remember seeing both "must use Gmail" and "must not use Gmail" in the past... The only correct to validate email addresses is to just send a message there and see if the user can click the confirmation link. Chances are that would be the next step in any signup flow anyway, so why introduce this artificial middle step of "validating the email address"?
  - tutfbhuf 6y ago
    One time email domains and email forward services are usually blocked, there are very long block lists for such domains. From my personal experience it is best to have a secondary email account on a provider that is usually not blocked (like gmail), to keep your primary email account clean.
  - throwaway123x2 6y ago
    I have a .family TLD as my primary address that gets refused because of bad regex half the time and consigned to spam the other half :(
  - martin_a 6y ago
    > use misguided measures such as a bad email validating regex Ever heard of Magento? They have that built in, at least in version 1. But it's a fixed list with "valid TLDs", anything not on that is not accepted when registering. Feels strange, when you can't register on your own shop...
m_st 6y ago
Good luck when this service goes down. But otherwise: Sounds great! Questions: 1. Is this new? 2. Why just 5 relays? How can I get more? 3. Is something like that available from 1Password? Would be a great addition.
- decrypt 6y ago
  1. No, been around for over six months. Possibly longer, but I got access sometime between June and August. 2. That may be a good questions for developers at #firefox-relay:mozilla.org (Matrix room) 3. It has come up in a few tweets in the past, but 1Password does not seem to have any plans for now. I use SimpleLogin browser extensions, and 1Password neatly picks up that alias address from my signup form.
- r2b2 6y ago
  Might be worth checking out Owl Mail [https://owlmail.io https://owlmail.io]. A few bonuses: • Larger attachments, 5MB + some wiggle room depending on the message size. • Replies (single and multi-party) in beta. • More addresses (a generous free tier, paid plans on the way). • Fast and simple UI.
ordx 6y ago
Services like this usually get banned by a lot of websites for various reasons. One solution could be to rotate domains from time to time, but I doubt they gonna do this.
emphatizer2000 6y ago
Until they deplatform you and all of your email addresses stop working.
deleted 6y ago
[deleted]
sacred-rat 6y ago
I have been using AnonAddy[0] for this, with great results. I initially used Firefox Relay, but switched to get more than 5 aliases. AnonAddy also recently added support for replies. [0] https://anonaddy.com/ https://anonaddy.com/
- decrypt 6y ago
  I thought support for replies was available for a long time. Happy SimpleLogin [1] customer here, which has a pricing similar to that of AnonAddy's highest tier. [1] https://simplelogin.io https://simplelogin.io
  - pj1115 6y ago
    This looks great. What I couldn't easily find for any of these services was a comparison with just using a catch-all address. I already have that in place. What sold SimpleLogin and AnonAddy for you?
  - sacred-rat 6y ago
    Looks like it came out Feb last year[0], so it has been out for awhile. I just learned about it recently. [0] https://anonaddy.com/blog/sending-email-from-an-alias-and-updated-replies/ https://anonaddy.com/blog/sending-email-from-an-alias-and-up...
- 6ak74rfy 6y ago
  Seconding the recommendation. One of the best things about AnonAddy is that it allows you to create aliases on the fly. So, I hardly even need to visit their website, browser extension or anything.
- nicholascamera 6y ago
  Discovered AnonAddy (which my friends and I call AnonDaddy) last week and I'm in love. The reply function works perfectly. I cannot stop suggesting it to people. Unfortunately HackMD rejects the anonaddy.com TLD, so I've had to use my "real" address there, but so far everywhere else it works fine. A clever friend realized you can register a new github account with an anonaddy address and use that to connect to HackMD. Smart. Great service. Free tier is great. Will probably end up paying and adding my own domain for the odd site that rejects theirs. The only feature I'd like is greater bandwidth allowance per month on the lite plan. Current limits are 10MB per month free tier, 50MB on $1/mo lite tier, and unlimited on Pro. But fair enough.
cimnine 6y ago
Cool, the source is available: https://github.com/mozilla/fx-private-relay https://github.com/mozilla/fx-private-relay Edit: I've previously claimed it to be open source. But there's no License currently that would indicate that.
- vaduz 6y ago
  Source available, at best, not open source. Licence is missing in both the code and in the terms page [0] unless I am going blind. Edit: if I am going blind, I am not the only one [1] [0] https://www.mozilla.org/en-US/about/legal/terms/firefox-relay/ https://www.mozilla.org/en-US/about/legal/terms/firefox-rela... [1] https://github.com/mozilla/fx-private-relay/issues/773 https://github.com/mozilla/fx-private-relay/issues/773
  - cimnine 6y ago
    You're right. I've updated my comment accordingly.
  - Macha 6y ago
    package.json lists it as MPL at least: https://github.com/mozilla/fx-private-relay/blob/18d491db346221aca8202008abcb995c0d4657ac/package.json#L15 https://github.com/mozilla/fx-private-relay/blob/18d491db346... Hopefully they make it clearer
- groovecoder 6y ago
  (Relay tech lead) Oops, thanks for catching that. We'll add a LICENSE file.
SV_BubbleTime 6y ago
I like the idea. But relay.firefox.com could have been shorter, I suppose it doesn’t matter here because the extension is supposed to roll you a new one and paste it in. But I’d like a service with a shorter domain for reading to people over the phone or at a store, double especially when it’s a throwaway anyhow.
- remram 6y ago
  In particular, the two dots after the @ are probably going to be blocked by many validation regexes.
- r2b2 6y ago
  If domain succinctness is your dream, have a gander at Owl Mail [https://owlmail.io https://owlmail.io].
elliotlarson 6y ago
I don't know. It's so easy to just create a random Gmail address and forward email from it. Maybe this makes it easier, but Gmail is one of the few Google products that I feel pretty confident will be around for a long time.
- decrypt 6y ago
  One still has to enter a mobile number to sign up for that Google account. But the larger difference is, that account would still be a standalone email address, which just happens to forward to your main Gmail address. But Firefox Relay (and similar products, like AnonAddy and SimpleLogin) are alias services. The idea with these services is to create addresses that can be immediately blocked, if they get into the hands of spammers. I am a happy SimpleLogin customer, and have made as many as 200 addresses. AnonAddy is a great start too, for those that need unlimited addresses. Both allow responding from those addresses, while AnonAddy's count is less.
  - Normille 6y ago
    Yandex Mail [0] is a better choice for this than Gmail. It also asks for a phone number to validate, on sign up. But there's a box you can tick which says something like "I don't have a mobile phone" and then you can validate with a Captcha instead [0]https://mail.yandex.com https://mail.yandex.com
  - elliotlarson 6y ago
    Ah, okay. Those are fair points.
dominotw 6y ago
I don't consider my email to be valuable enough to be hidden. I don't use email at all other than to do very mundane tasks.
- mosselman 6y ago
  I once saw a comment on an auction on a yellow commode someone was advertising. It read "No thank, I am looking for a blue one". Your comment made me think of that.
jamesboehmer 6y ago
IMO if you're really concerned about anonymity and securing your email from credential-stuffing, and willing to pay for such a service (I used to pay for 33mail), it's easier to just buy a domain and route * to your inbox. It won't get banned by some services, you have complete control over the domain and account, you can send email from any address you wish, you can sign up for domain-wide haveibeenpwned alerts by verifying domain ownership via TXT records, and you don't have to worry about the service going out of business in 2 years. After going through my password manager last year and changing as many logins and emails as I could, I've found several services that have sold my email address to third parties and one that was hacked. It's a relief to know I don't have all my proverbial email eggs in one basket.
- jszymborski 6y ago
  I do the catchall thing too, but Migadu has an API for creating aliases... I think it'd be pretty cool to create a little script to generate random aliases and keep track of them.
- blindm 6y ago
  > it's easier to just buy a domain and route * to your inbox There is the caveat of the domain getting into the wrong hands, if you look long enough down the road. What if you die, or simply can't afford to renew the domain well into the future? I know if I could look down from heaven after I die and saw someone re-registering my dropped domain, I would be furious! Then there is the issue of even when you're alive, you could simply refuse to renew for whatever reason and the domain is suddenly someone else's. MarkMonitor and Epik are the only companies that I know of that can safeguard against this. Epik has so called 'forever domains' and ensure the domain stays active well into the future.
  - arpa 6y ago
    It's just a domain, man, chill, don't let it drag you down. Why should you feel so strongly about transient things? It's just a name...
    - 6y ago
jannes 6y ago
Here is the list of permission the extension requires: - Access your data for all web sites If even the browser vendor can't do better than requesting access to everything I'm not surprised that we end up with extensions being sold and abused (for their permissions).
- jpalomaki 6y ago
  I would like to see these extensions only activating when I click them on toolbar. Most extensions I could consider are only needed for few pages.
  - Seb-C 6y ago
    As a developer, I can say that this is maybe possible, but not easy. Because so many things have to be hardcoded in the manifest, the code and UK gets complicated and messy quickly if you try to workaround to provide both ways.
- groovecoder 6y ago
  (Relay tech lead here) Yeah, the all_urls add-ons are always concerning. We have an issue filed to move that to optional_permissions instead, but need to get the UX right: https://github.com/mozilla/fx-private-relay/issues/252 https://github.com/mozilla/fx-private-relay/issues/252
thecrumb 6y ago
Firefox is a bit like Google. They roll these out and then a year later they kill them. Looking at you Firefox send. So I'll pass.
- rileyteige 6y ago
  > Firefox Send What a letdown to see this service so quickly retired.
- nexthash 6y ago
  To be fair to Firefox, the only reason there is such a high rate of churn with their services is that they are trying to preserve their mission in the face of competition with Big Tech giants like Google. The more you support Firefox, the more likely it will be that this service will stick.
stephenc_c_ 6y ago
Similar to Apple's option https://support.apple.com/en-us/HT210425 https://support.apple.com/en-us/HT210425
- jacurtis 6y ago
  The concept is similar. But Apple only provides this feature on sites that impliment "Sign in with Apple". Firefox Relay allows you to create these relays on the fly, ad-hoc to put into any email field on the web (like sign up for my newsletter fields).
niftylettuce 6y ago
I encourage you to instead try out https://forwardemail.net https://forwardemail.net. I'm launching our browser extension and our SMTP service very soon. It's completely open-source and free. No logging either. We're the only service that doesn't write emails let alone logs to disk nor store any metadata. You can use unlimited custom domains and create disposable aliases on the fly as well! (I'm the creator, lmk any questions!)
- zanecraw 6y ago
  Awesome! Just signed up for the free plan and looking forward for this browser extension.
- remilee 6y ago
  Super easy to set up, thanks!
- azinman2 6y ago
  > “ Unlike other services, we do not keep logs nor metadata, never read emails, and are 100% open-source.” So how do you prevent abuse?
  - niftylettuce 6y ago
    I created tools such as https://spamscanner.net https://spamscanner.net and use ARC + ARF.
    - GordonS 6y ago
      I'm familiar with DKIM and SPF, but haven't come across the acronyms ARC or ARF before?
- riedel 6y ago
  Should always use two or more of such services in a cascade to generate a mix network for true anonymity. Wait: The E-Mail forwarder would actually need to remove the To: fields to support this...
remram 6y ago
I assume emails @relay.firefox.com will be banned from every form in a week or two, the same way @yopmail.com is?
- Vixel 6y ago
  My thoughts exactly. I've even run into sites that don't allow tutanota
- kilroy123 6y ago
  That was the very first thought that popped into my head.
devj 6y ago
Since Firefox has partnered with Amazon(SES) to filter spam, does it mean that Amazon can read our emails too?
- groovecoder 6y ago
  (Relay tech lead here) It's in the privacy policy (https://www.mozilla.org/en-US/privacy/firefox-relay/ https://www.mozilla.org/en-US/privacy/firefox-relay/), but yes - the emails are sent thru Amazon SES in plaintext. We have kicked around the idea of enabling + preserving E2EE emails thru Relay, but ... it's tricky. https://github.com/mozilla/fx-private-relay/issues/360 https://github.com/mozilla/fx-private-relay/issues/360
yumraj 6y ago
Why can't Mozilla launch a freemium email service is beyond me. Free email with Firefox domain. Paid with custom domain.
- nexthash 6y ago
  This is most likely due to the enormous capital needed to start such a service. I suspect if they were successful it would be all-paid at first.
  - yumraj 6y ago
    I'll pay Mozilla and based on prior discussion on HN, I'm sure a lot of people will pay Mozilla for a paid email service just because of their reputation.
- seqizz 6y ago
  From wikipedia: > In 2006, the Mozilla Corporation generated $66.8 million in revenue and $19.8 million in expenses, with 85% of that revenue coming from Google for "assigning [Google] as the browser's default search engine, and for click-throughs on ads placed on the ensuing search results pages." I don't think Google would like it.
gspr 6y ago
That's nice and convenient, Mozilla, but Firefox the browser is an essential piece of software at this point. How about focusing your precious cash on that?
- nexthash 6y ago
  Essential, but maintaining a browser in the face of enormous competition from Google and Microsoft is tough. If you support Firefox with these new endeavors, you are helping preserve the browser as well. Since times are changing, Mozilla must either adapt or be out-competed.
  - gspr 6y ago
    How, exactly? I'm happy to donate to Mozilla. If the money is spent on FF.
    - lxgr 6y ago
      It's the same logic by which NGOs send physical mail and even small gifts like greetings cards and personalized stationery encouraging people to donate again: That's not what I'm donating to an NGO for, but if doing so nets them more donations usable for their causes in the end, that's something I can get behind. If Mozilla can find ways to generate additional income that also align with their values and don't put them into conflicts of interest, I can get behind that. (The management isn't exactly known for frugality and excellence in resource allocation though, so I'm taking it with a grain of salt.)
jwineinger 6y ago
> Firefox Relay supports email forwarding (including attachments) of email up to 150KB in size > Any emails larger than 150KB will not be forwarded. I'm not sure what to think of the size limitation. I wonder what percentage of emails are under that.
- tandr 6y ago
  They probably going to remove this restriction as part of payable services.
garysahota93 6y ago
I've set something like this up with Google Domains + Gmail for free (well, the yearly cost of the domain, but yeah) I was able to set up alias emails in my gmail & have all emails from a particular domain forward to my domain as well. Then went with a password manager & changed all my email addresses to my own domain with specific relays (amazon@ netflix@ etc etc) Works really well for ~12/year!
- r2b2 6y ago
  This gives you the benefit of disable-able email addresses, but not the benefit of privacy. Those companies (and once leaked, anyone) can use your custom email domain as a fingerprint for your online activity. (Source, I'm the creator of Owl Mail [https://owlmail.io https://owlmail.io] and this is a common question.)
  - skarz 6y ago
    How is Owl Mail funded?
    - r2b2 6y ago
      There will be paid plans.
  - garysahota93 6y ago
    Interesting. Curious: how is that any different than if owlmail gets leaked?
    - r2b2 6y ago
      If you give your personal email address to hundreds of services online one of them is bound to sell or leak your email. By using Owl Mail (or Firefox Relay, etc.) addresses everywhere, you reduce your attack surface to one security fastidious company. And, even if Owl Mail (or Firefox Relay, etc.) were to experience a data breach, at least it would greatly increase the effort required to match emails to your identity. To really protect yourself, use a double relay! External -> Relay 1 -> Relay 2 -> Your Inbox Then you will have some serious resilience :D
tandr 6y ago
So, the same idea that is https://sneakemail.com https://sneakemail.com ? (happy user for like 12 years?)
deleted 6y ago
[deleted]
megous 6y ago
I generate long completely random aliases also for other reason: to help with phishing detection. I store aliases in DB along with a short description of to whom they were issued, and some extra flags. My mail client then highlights emails sent to these aliases in green color and shows their description instead of the alias itself in the "From" column of the message list. I always give random aliases to online services, eshops, shipping companies, etc. These private aliases will never receive SPAM, or phishing, unless leaked by the company. Anything that looks like a transactional email from some service, and is not sent to private alias, just gets deleted right away. It's not even worth opening, no matter how good it looks. And I can keep my phishing guard up on much lower volume of green emails. It also makes whitelisting transactional email easier, without allowing random SPAM to the Inbox, because filtering based on the "shared secret" per company delivery address will allow in all important email from the company, regardless of how or from what address it was sent.
- privacyking 6y ago
  Can you share your script for that?
dastx 6y ago
Is this something similar to https://simplelogin.io/ https://simplelogin.io/? If it is, simplelogin is a self-hostable solution. If you're really worried about privacy, this would cut out the possibility that Mozilla might be reading your messages.
FloatArtifact 6y ago
Is there something like this privacy oriented for phone numbers?
- r2b2 6y ago
  I've looked into building this for phone numbers. The main problem is that phone numbers are expensive to own. All the solutions that exist "rent" you numbers temporarily so that prices are reasonable.
imrankhan17 6y ago
So this is like a VPN but for email?
r2b2 6y ago
I built Owl Mail [https://owlmail.io https://owlmail.io] to solve this same problem. I think you will find Owl Mail a fast and easy to use alternative to FF relay. Congrats to FF Relay – more products in this space will be a win for better privacy online :)
Shorn 6y ago
Where's the pricing page?
dschuessler 6y ago
There's a self-hostable alternative called Inboxen (https://inboxen.org/ https://inboxen.org/) I haven't gotten around to setting it up yet, unfortunately.
skarz 6y ago
Limited to 5 aliases? GTFOH, even AnonAddy offers more than that...
brightsize 6y ago
Another option for an email relay service is the venerable Spamgourmet[0]. I'm a long time-user (a decade at least) and according to the site "Your message stats: 11,298 forwarded, 27,539 eaten. You have 172 spamgourmet address(es)." I haven't had too many problems with the service, mainly the problems are with third-parties that block the spamgourmet.com domain but there are alternate, more obscure domain names that can be used (such as @xoxy.net IIRC). There are plusses and minuses to SG, but it's free as in beer and if your Perl and ops chops are in good shape the code is available for self-hosting. The hosted service does not support bringing your own domain but has other nifty features that might appeal to HN power users. Worth a look if you're in the market for this kind of thing. [0] https://www.spamgourmet.com/index.pl https://www.spamgourmet.com/index.pl
vldr 6y ago
I installed the extension. Turns out you only get 5 aliases which makes it kinda useless. Also, it seems to forward to the address associated with your firefox account (which could end up at a mailprovider you don't want the relayed emails to go to) I'll stick with my own *@sub.example.com forwarding setup in stead.
astrostl 6y ago
Ages ago I used "Bigfoot"'s free email forwarding for life. Which turned into a subset of email with limitations, fees, ads, and eventually shutdown. Later I had my own domain, and did the address-per-site thing. Which was an absolute nightmare to undo when I sold the domain (grepping thru the raw self-hosted mbox and logging into and changing my email on hundreds of sites), although it was a great excuse to get going on using a password manager. At this point I could use "plus addressing" at Fastmail (e.g. amazon+me@domain.com), but I find the endeavor pretty pointless. My spam is low, and I never once found it especially valuable to be able to identify or isolate an offending domain. I don't expect that Firefox will go "full Bigfoot" on this one in terms of ads and fees but shutdown is a PITA risk. I would personally only use this kind of stuff for genuine one-offs where anonymity is paramount (read: probably not at all).
bg117 6y ago
Looks similar to Bigfoot in the late 90s&2000s

352 points by charlieirish 6y ago

And what happens when FireFox decides to drop this option 1-2 years into the future? I reckon they'll give time to change the email address on all the pages one used it for, but still... nvm, it's in the FAQ: "What happens if Mozilla shuts down the Firefox Relay service? We will give you advance notice that you need to change the email address of any accounts that are using Relay aliases." Note that one cannot reply using this service (yet). So the whole anonymity is gone as soon as one wants to contact some service without disclosing the real address (?)

maxrovertsb 6y ago
It's nice that they are being transparent about it.
m-p-3 6y ago
> And what happens when FireFox decides to drop this option 1-2 years into the future? The same thing if any other company did it. That said, I do hope they'll offer an option to pay for more email relays which could also ensure its viability. Having 5 relays for free is nice, but I'd personally use a unique address per service.
mk89 6y ago
Just a proper email provider that offers this features. Fastmail, GMX, ...
tyingq 6y ago
I do miss Firefox Send.
- decrypt 6y ago
  Same. I have been using Tresorit Send [1] and Visée's (developer of ffsend CLI tool) Firefox Send instance [2] in the meantime. Visée is also looking for donations [3] to support hosting of that instance. [1] https://send.tresorit.com https://send.tresorit.com [2] https://send.visee.com https://send.visee.com [3] https://gitlab.com/timvisee/ffsend/-/issues/100#note_376316378 https://gitlab.com/timvisee/ffsend/-/issues/100#note_3763163...
  - PufPufPuf 6y ago
    The correct URL for the Firefox Send instance is https://send.vis.ee/ https://send.vis.ee/
  - timvisee 6y ago
    Thanks for mentioning Send and ffsend! Yeah, the instance is available at: https://send.vis.ee/ https://send.vis.ee/
- lights0123 6y ago
  https://news.ycombinator.com/item?id=25524472 https://news.ycombinator.com/item?id=25524472 is certainly not a complete replacement, but most of the time I used it locally so that would work.
- Whitecoyote 6y ago
  I miss it too, it was so convenient. I use https://transfer.sh https://transfer.sh instead.
eloisant 6y ago
I'm probably going to use it for "throw-away" email. As in, I just need to receive a link right now so the service think they have my real address, after that the alias might as well be trashed. The only thing I'm worried is that this domain will soon be blacklisted by services (especially those I don't want to give my email address to).
- josepmdc 6y ago
  For that use case you can just use a temporary email provider like temp-mail.org which are harder to blacklist since they have a lot of random domains.
  - SamuelAdams 6y ago
    Yep I often use "ten minute mail" for this too.
  - PufPufPuf 6y ago
    Firefox Relay seems easier to use, thanks to the one-click generated emails by the browser extension and the fact that the emails arrive in your actual inbox. But I agree that the domain is going to land on all the blacklists -- I hope they implement alternative domains for this reason.
groovecoder 6y ago
Howdy. I'm the tech lead on Relay. We're working on replies right now: https://github.com/mozilla/fx-private-relay/pull/770 https://github.com/mozilla/fx-private-relay/pull/770
- lecarore 6y ago
  While you're here, can you test the relay dashboard (where you can create aliases) on Firefox for Android 84.1.4 ? The scroll is incredibly sluggish, I don't know what scroll effect you added but please have a look. It's a bit unfortunate for a Mozilla service ^^ I can provide you a screen capture if needed.
  - groovecoder 6y ago
    Can you file that here so I don't forget? https://github.com/mozilla/fx-private-relay https://github.com/mozilla/fx-private-relay
megous 6y ago
You usually don't need the address you registered some account with to change account email to something else. Services usually just verify you control the new email address.
r2b2 6y ago
Founder of Owl Mail [https://owlmail.io https://owlmail.io] here. It's easy for me to promise Owl Mail will not shut down without significant advanced notice (hopefully that never happens, but if it does I will provide a clear transition plan for all users). As a token of confidence, I've moved all ~150 of my online accounts (including all banking, financial, and healthcare accounts) to Owl Mail – it needs to exist for my life to operate smoothly.
- neogodless 6y ago
  From your home page I get the impression you only support having generated @owlmail.io email addresses. Is that accurate? Does your system track which online service gets which email, or do you track that yourself in a password manager?
  - r2b2 6y ago
    1. Yes, only @owlmail.io domains for now. But, Owl Mail will allow for custom domains soon. 2. An upcoming feature will enable the creation of sender 'allow' and 'deny' lists for each Owl Mail address (With default sender 'allow' lists for top sites). Currently I track my account credentials in a password manager. A browser extension is also on Owl Mail's roadmap.

allendoerfer 6y ago

Will be added to the list of domains people cannot use to sign up for accounts. In my experience, this only works on small sites.

cmeacham98 6y ago
In my experience it is the other way around. Big name websites generally have enough users that email "just works". Smaller websites are more likely to use misguided measures such as a bad email validating regex (hello to anyone with a non-standard TLD!), only allowing gmail, or blacklisting domains like these.
- lxgr 6y ago
  +1, and ironically I remember seeing both "must use Gmail" and "must not use Gmail" in the past... The only correct to validate email addresses is to just send a message there and see if the user can click the confirmation link. Chances are that would be the next step in any signup flow anyway, so why introduce this artificial middle step of "validating the email address"?
- tutfbhuf 6y ago
  One time email domains and email forward services are usually blocked, there are very long block lists for such domains. From my personal experience it is best to have a secondary email account on a provider that is usually not blocked (like gmail), to keep your primary email account clean.
- throwaway123x2 6y ago
  I have a .family TLD as my primary address that gets refused because of bad regex half the time and consigned to spam the other half :(
- martin_a 6y ago
  > use misguided measures such as a bad email validating regex Ever heard of Magento? They have that built in, at least in version 1. But it's a fixed list with "valid TLDs", anything not on that is not accepted when registering. Feels strange, when you can't register on your own shop...

m_st 6y ago

Good luck when this service goes down. But otherwise: Sounds great! Questions: 1. Is this new? 2. Why just 5 relays? How can I get more? 3. Is something like that available from 1Password? Would be a great addition.

decrypt 6y ago
1. No, been around for over six months. Possibly longer, but I got access sometime between June and August. 2. That may be a good questions for developers at #firefox-relay:mozilla.org (Matrix room) 3. It has come up in a few tweets in the past, but 1Password does not seem to have any plans for now. I use SimpleLogin browser extensions, and 1Password neatly picks up that alias address from my signup form.
r2b2 6y ago
Might be worth checking out Owl Mail [https://owlmail.io https://owlmail.io]. A few bonuses: • Larger attachments, 5MB + some wiggle room depending on the message size. • Replies (single and multi-party) in beta. • More addresses (a generous free tier, paid plans on the way). • Fast and simple UI.

ordx 6y ago

Services like this usually get banned by a lot of websites for various reasons. One solution could be to rotate domains from time to time, but I doubt they gonna do this.

emphatizer2000 6y ago

Until they deplatform you and all of your email addresses stop working.

deleted 6y ago

[deleted]

sacred-rat 6y ago

I have been using AnonAddy[0] for this, with great results. I initially used Firefox Relay, but switched to get more than 5 aliases. AnonAddy also recently added support for replies. [0] https://anonaddy.com/ https://anonaddy.com/

decrypt 6y ago
I thought support for replies was available for a long time. Happy SimpleLogin [1] customer here, which has a pricing similar to that of AnonAddy's highest tier. [1] https://simplelogin.io https://simplelogin.io
- pj1115 6y ago
  This looks great. What I couldn't easily find for any of these services was a comparison with just using a catch-all address. I already have that in place. What sold SimpleLogin and AnonAddy for you?
- sacred-rat 6y ago
  Looks like it came out Feb last year[0], so it has been out for awhile. I just learned about it recently. [0] https://anonaddy.com/blog/sending-email-from-an-alias-and-updated-replies/ https://anonaddy.com/blog/sending-email-from-an-alias-and-up...
6ak74rfy 6y ago
Seconding the recommendation. One of the best things about AnonAddy is that it allows you to create aliases on the fly. So, I hardly even need to visit their website, browser extension or anything.
nicholascamera 6y ago
Discovered AnonAddy (which my friends and I call AnonDaddy) last week and I'm in love. The reply function works perfectly. I cannot stop suggesting it to people. Unfortunately HackMD rejects the anonaddy.com TLD, so I've had to use my "real" address there, but so far everywhere else it works fine. A clever friend realized you can register a new github account with an anonaddy address and use that to connect to HackMD. Smart. Great service. Free tier is great. Will probably end up paying and adding my own domain for the odd site that rejects theirs. The only feature I'd like is greater bandwidth allowance per month on the lite plan. Current limits are 10MB per month free tier, 50MB on $1/mo lite tier, and unlimited on Pro. But fair enough.

cimnine 6y ago

Cool, the source is available: https://github.com/mozilla/fx-private-relay https://github.com/mozilla/fx-private-relay Edit: I've previously claimed it to be open source. But there's no License currently that would indicate that.

vaduz 6y ago
Source available, at best, not open source. Licence is missing in both the code and in the terms page [0] unless I am going blind. Edit: if I am going blind, I am not the only one [1] [0] https://www.mozilla.org/en-US/about/legal/terms/firefox-relay/ https://www.mozilla.org/en-US/about/legal/terms/firefox-rela... [1] https://github.com/mozilla/fx-private-relay/issues/773 https://github.com/mozilla/fx-private-relay/issues/773
- cimnine 6y ago
  You're right. I've updated my comment accordingly.
- Macha 6y ago
  package.json lists it as MPL at least: https://github.com/mozilla/fx-private-relay/blob/18d491db346221aca8202008abcb995c0d4657ac/package.json#L15 https://github.com/mozilla/fx-private-relay/blob/18d491db346... Hopefully they make it clearer
groovecoder 6y ago
(Relay tech lead) Oops, thanks for catching that. We'll add a LICENSE file.

SV_BubbleTime 6y ago

I like the idea. But relay.firefox.com could have been shorter, I suppose it doesn’t matter here because the extension is supposed to roll you a new one and paste it in. But I’d like a service with a shorter domain for reading to people over the phone or at a store, double especially when it’s a throwaway anyhow.

remram 6y ago
In particular, the two dots after the @ are probably going to be blocked by many validation regexes.
r2b2 6y ago
If domain succinctness is your dream, have a gander at Owl Mail [https://owlmail.io https://owlmail.io].

elliotlarson 6y ago

I don't know. It's so easy to just create a random Gmail address and forward email from it. Maybe this makes it easier, but Gmail is one of the few Google products that I feel pretty confident will be around for a long time.

decrypt 6y ago
One still has to enter a mobile number to sign up for that Google account. But the larger difference is, that account would still be a standalone email address, which just happens to forward to your main Gmail address. But Firefox Relay (and similar products, like AnonAddy and SimpleLogin) are alias services. The idea with these services is to create addresses that can be immediately blocked, if they get into the hands of spammers. I am a happy SimpleLogin customer, and have made as many as 200 addresses. AnonAddy is a great start too, for those that need unlimited addresses. Both allow responding from those addresses, while AnonAddy's count is less.
- Normille 6y ago
  Yandex Mail [0] is a better choice for this than Gmail. It also asks for a phone number to validate, on sign up. But there's a box you can tick which says something like "I don't have a mobile phone" and then you can validate with a Captcha instead [0]https://mail.yandex.com https://mail.yandex.com
- elliotlarson 6y ago
  Ah, okay. Those are fair points.

dominotw 6y ago

I don't consider my email to be valuable enough to be hidden. I don't use email at all other than to do very mundane tasks.

mosselman 6y ago
I once saw a comment on an auction on a yellow commode someone was advertising. It read "No thank, I am looking for a blue one". Your comment made me think of that.

jamesboehmer 6y ago

IMO if you're really concerned about anonymity and securing your email from credential-stuffing, and willing to pay for such a service (I used to pay for 33mail), it's easier to just buy a domain and route * to your inbox. It won't get banned by some services, you have complete control over the domain and account, you can send email from any address you wish, you can sign up for domain-wide haveibeenpwned alerts by verifying domain ownership via TXT records, and you don't have to worry about the service going out of business in 2 years. After going through my password manager last year and changing as many logins and emails as I could, I've found several services that have sold my email address to third parties and one that was hacked. It's a relief to know I don't have all my proverbial email eggs in one basket.

jszymborski 6y ago
I do the catchall thing too, but Migadu has an API for creating aliases... I think it'd be pretty cool to create a little script to generate random aliases and keep track of them.
blindm 6y ago
> it's easier to just buy a domain and route * to your inbox There is the caveat of the domain getting into the wrong hands, if you look long enough down the road. What if you die, or simply can't afford to renew the domain well into the future? I know if I could look down from heaven after I die and saw someone re-registering my dropped domain, I would be furious! Then there is the issue of even when you're alive, you could simply refuse to renew for whatever reason and the domain is suddenly someone else's. MarkMonitor and Epik are the only companies that I know of that can safeguard against this. Epik has so called 'forever domains' and ensure the domain stays active well into the future.
- arpa 6y ago
  It's just a domain, man, chill, don't let it drag you down. Why should you feel so strongly about transient things? It's just a name...
  - 6y ago

jannes 6y ago

Here is the list of permission the extension requires: - Access your data for all web sites If even the browser vendor can't do better than requesting access to everything I'm not surprised that we end up with extensions being sold and abused (for their permissions).

jpalomaki 6y ago
I would like to see these extensions only activating when I click them on toolbar. Most extensions I could consider are only needed for few pages.
- Seb-C 6y ago
  As a developer, I can say that this is maybe possible, but not easy. Because so many things have to be hardcoded in the manifest, the code and UK gets complicated and messy quickly if you try to workaround to provide both ways.
groovecoder 6y ago
(Relay tech lead here) Yeah, the all_urls add-ons are always concerning. We have an issue filed to move that to optional_permissions instead, but need to get the UX right: https://github.com/mozilla/fx-private-relay/issues/252 https://github.com/mozilla/fx-private-relay/issues/252

thecrumb 6y ago

Firefox is a bit like Google. They roll these out and then a year later they kill them. Looking at you Firefox send. So I'll pass.

rileyteige 6y ago
> Firefox Send What a letdown to see this service so quickly retired.
nexthash 6y ago
To be fair to Firefox, the only reason there is such a high rate of churn with their services is that they are trying to preserve their mission in the face of competition with Big Tech giants like Google. The more you support Firefox, the more likely it will be that this service will stick.

stephenc_c_ 6y ago

Similar to Apple's option https://support.apple.com/en-us/HT210425 https://support.apple.com/en-us/HT210425

jacurtis 6y ago
The concept is similar. But Apple only provides this feature on sites that impliment "Sign in with Apple". Firefox Relay allows you to create these relays on the fly, ad-hoc to put into any email field on the web (like sign up for my newsletter fields).

niftylettuce 6y ago

I encourage you to instead try out https://forwardemail.net https://forwardemail.net. I'm launching our browser extension and our SMTP service very soon. It's completely open-source and free. No logging either. We're the only service that doesn't write emails let alone logs to disk nor store any metadata. You can use unlimited custom domains and create disposable aliases on the fly as well! (I'm the creator, lmk any questions!)

zanecraw 6y ago
Awesome! Just signed up for the free plan and looking forward for this browser extension.
remilee 6y ago
Super easy to set up, thanks!
azinman2 6y ago
> “ Unlike other services, we do not keep logs nor metadata, never read emails, and are 100% open-source.” So how do you prevent abuse?
- niftylettuce 6y ago
  I created tools such as https://spamscanner.net https://spamscanner.net and use ARC + ARF.
  - GordonS 6y ago
    I'm familiar with DKIM and SPF, but haven't come across the acronyms ARC or ARF before?
riedel 6y ago
Should always use two or more of such services in a cascade to generate a mix network for true anonymity. Wait: The E-Mail forwarder would actually need to remove the To: fields to support this...

remram 6y ago

I assume emails @relay.firefox.com will be banned from every form in a week or two, the same way @yopmail.com is?

Vixel 6y ago
My thoughts exactly. I've even run into sites that don't allow tutanota
kilroy123 6y ago
That was the very first thought that popped into my head.

devj 6y ago

Since Firefox has partnered with Amazon(SES) to filter spam, does it mean that Amazon can read our emails too?

groovecoder 6y ago
(Relay tech lead here) It's in the privacy policy (https://www.mozilla.org/en-US/privacy/firefox-relay/ https://www.mozilla.org/en-US/privacy/firefox-relay/), but yes - the emails are sent thru Amazon SES in plaintext. We have kicked around the idea of enabling + preserving E2EE emails thru Relay, but ... it's tricky. https://github.com/mozilla/fx-private-relay/issues/360 https://github.com/mozilla/fx-private-relay/issues/360

yumraj 6y ago

Why can't Mozilla launch a freemium email service is beyond me. Free email with Firefox domain. Paid with custom domain.

nexthash 6y ago
This is most likely due to the enormous capital needed to start such a service. I suspect if they were successful it would be all-paid at first.
- yumraj 6y ago
  I'll pay Mozilla and based on prior discussion on HN, I'm sure a lot of people will pay Mozilla for a paid email service just because of their reputation.
seqizz 6y ago
From wikipedia: > In 2006, the Mozilla Corporation generated $66.8 million in revenue and $19.8 million in expenses, with 85% of that revenue coming from Google for "assigning [Google] as the browser's default search engine, and for click-throughs on ads placed on the ensuing search results pages." I don't think Google would like it.

gspr 6y ago

That's nice and convenient, Mozilla, but Firefox the browser is an essential piece of software at this point. How about focusing your precious cash on that?

nexthash 6y ago
Essential, but maintaining a browser in the face of enormous competition from Google and Microsoft is tough. If you support Firefox with these new endeavors, you are helping preserve the browser as well. Since times are changing, Mozilla must either adapt or be out-competed.
- gspr 6y ago
  How, exactly? I'm happy to donate to Mozilla. If the money is spent on FF.
  - lxgr 6y ago
    It's the same logic by which NGOs send physical mail and even small gifts like greetings cards and personalized stationery encouraging people to donate again: That's not what I'm donating to an NGO for, but if doing so nets them more donations usable for their causes in the end, that's something I can get behind. If Mozilla can find ways to generate additional income that also align with their values and don't put them into conflicts of interest, I can get behind that. (The management isn't exactly known for frugality and excellence in resource allocation though, so I'm taking it with a grain of salt.)

jwineinger 6y ago

> Firefox Relay supports email forwarding (including attachments) of email up to 150KB in size > Any emails larger than 150KB will not be forwarded. I'm not sure what to think of the size limitation. I wonder what percentage of emails are under that.

tandr 6y ago
They probably going to remove this restriction as part of payable services.

garysahota93 6y ago

I've set something like this up with Google Domains + Gmail for free (well, the yearly cost of the domain, but yeah) I was able to set up alias emails in my gmail & have all emails from a particular domain forward to my domain as well. Then went with a password manager & changed all my email addresses to my own domain with specific relays (amazon@ netflix@ etc etc) Works really well for ~12/year!

r2b2 6y ago
This gives you the benefit of disable-able email addresses, but not the benefit of privacy. Those companies (and once leaked, anyone) can use your custom email domain as a fingerprint for your online activity. (Source, I'm the creator of Owl Mail [https://owlmail.io https://owlmail.io] and this is a common question.)
- skarz 6y ago
  How is Owl Mail funded?
  - r2b2 6y ago
    There will be paid plans.
- garysahota93 6y ago
  Interesting. Curious: how is that any different than if owlmail gets leaked?
  - r2b2 6y ago
    If you give your personal email address to hundreds of services online one of them is bound to sell or leak your email. By using Owl Mail (or Firefox Relay, etc.) addresses everywhere, you reduce your attack surface to one security fastidious company. And, even if Owl Mail (or Firefox Relay, etc.) were to experience a data breach, at least it would greatly increase the effort required to match emails to your identity. To really protect yourself, use a double relay! External -> Relay 1 -> Relay 2 -> Your Inbox Then you will have some serious resilience :D

tandr 6y ago

So, the same idea that is https://sneakemail.com https://sneakemail.com ? (happy user for like 12 years?)

deleted 6y ago

[deleted]

megous 6y ago

I generate long completely random aliases also for other reason: to help with phishing detection. I store aliases in DB along with a short description of to whom they were issued, and some extra flags. My mail client then highlights emails sent to these aliases in green color and shows their description instead of the alias itself in the "From" column of the message list. I always give random aliases to online services, eshops, shipping companies, etc. These private aliases will never receive SPAM, or phishing, unless leaked by the company. Anything that looks like a transactional email from some service, and is not sent to private alias, just gets deleted right away. It's not even worth opening, no matter how good it looks. And I can keep my phishing guard up on much lower volume of green emails. It also makes whitelisting transactional email easier, without allowing random SPAM to the Inbox, because filtering based on the "shared secret" per company delivery address will allow in all important email from the company, regardless of how or from what address it was sent.

privacyking 6y ago
Can you share your script for that?

dastx 6y ago

Is this something similar to https://simplelogin.io/ https://simplelogin.io/? If it is, simplelogin is a self-hostable solution. If you're really worried about privacy, this would cut out the possibility that Mozilla might be reading your messages.

FloatArtifact 6y ago

Is there something like this privacy oriented for phone numbers?

r2b2 6y ago
I've looked into building this for phone numbers. The main problem is that phone numbers are expensive to own. All the solutions that exist "rent" you numbers temporarily so that prices are reasonable.

imrankhan17 6y ago

So this is like a VPN but for email?

r2b2 6y ago

I built Owl Mail [https://owlmail.io https://owlmail.io] to solve this same problem. I think you will find Owl Mail a fast and easy to use alternative to FF relay. Congrats to FF Relay – more products in this space will be a win for better privacy online :)

Shorn 6y ago

Where's the pricing page?

dschuessler 6y ago

There's a self-hostable alternative called Inboxen (https://inboxen.org/ https://inboxen.org/) I haven't gotten around to setting it up yet, unfortunately.

skarz 6y ago

Limited to 5 aliases? GTFOH, even AnonAddy offers more than that...

brightsize 6y ago

Another option for an email relay service is the venerable Spamgourmet[0]. I'm a long time-user (a decade at least) and according to the site "Your message stats: 11,298 forwarded, 27,539 eaten. You have 172 spamgourmet address(es)." I haven't had too many problems with the service, mainly the problems are with third-parties that block the spamgourmet.com domain but there are alternate, more obscure domain names that can be used (such as @xoxy.net IIRC). There are plusses and minuses to SG, but it's free as in beer and if your Perl and ops chops are in good shape the code is available for self-hosting. The hosted service does not support bringing your own domain but has other nifty features that might appeal to HN power users. Worth a look if you're in the market for this kind of thing. [0] https://www.spamgourmet.com/index.pl https://www.spamgourmet.com/index.pl

vldr 6y ago

I installed the extension. Turns out you only get 5 aliases which makes it kinda useless. Also, it seems to forward to the address associated with your firefox account (which could end up at a mailprovider you don't want the relayed emails to go to) I'll stick with my own *@sub.example.com forwarding setup in stead.

astrostl 6y ago

Ages ago I used "Bigfoot"'s free email forwarding for life. Which turned into a subset of email with limitations, fees, ads, and eventually shutdown. Later I had my own domain, and did the address-per-site thing. Which was an absolute nightmare to undo when I sold the domain (grepping thru the raw self-hosted mbox and logging into and changing my email on hundreds of sites), although it was a great excuse to get going on using a password manager. At this point I could use "plus addressing" at Fastmail (e.g. amazon+me@domain.com), but I find the endeavor pretty pointless. My spam is low, and I never once found it especially valuable to be able to identify or isolate an offending domain. I don't expect that Firefox will go "full Bigfoot" on this one in terms of ads and fees but shutdown is a PITA risk. I would personally only use this kind of stuff for genuine one-offs where anonymity is paramount (read: probably not at all).

bg117 6y ago

Looks similar to Bigfoot in the late 90s&2000s