3 ms·

Heh, I work on Relay and I do the same :) While the approach is great, especially in situations away from my computer where I can't generate a new alias in adva

by Vinnl 5y ago

Heh, I work on Relay and I do the same :) While the approach is great, especially in situations away from my computer where I can't generate a new alias in advance, working on it I discovered that using Relay still has a couple of advantages: - My other addresses are unguessable. - It's far easier to block emails sent to a single alias. With my own domain, I'll have to go and add a filter into which I copy-paste the particular alias I want to block. With Relay, I can just open the dashboard and hit the toggle next to the alias labelled with the domain I used it on. - I was looking for ways to give Mozilla money for a long time (though now I'm working there, so I guess I'm also taking its money). In general, my setup now is to keep using my old setup for long-term accounts with somewhat more reliable services, and use Relay for e.g. requesting a quotation or having a single thing shipped to me.

VTimofeenko 5y ago
On the unguessability of other addresses - I rotate several schemas making the mask of the address something like [service].[username].$(pwgen -1 | tr '[:upper:]' '[:lower:]')@customdomain. Sometimes "[service]" is also shortened like "hackernews -> hn" to dodge the ban on service name in the e-mail address that some service providers apparently have.
- Vinnl 5y ago
  Ah, I don't necessarily mean guessability of which other addresses I use, but of how you can reach me. If I block yourservice@mydomain.com, you can still attempt to reach me at totallynotyourservice@mydomain.com and it will work. You'll also be able to link my different addresses on different services. If I throw away the Relay alias for your service, that's it - there's no way to lead that back to me anymore.
  - VTimofeenko 5y ago
    Gotcha. > you can still attempt to reach me at totallynotyourservice@mydomain.com not if the catch-all address is actually /dev/null and the totallynotyourservice@ has to be mined from somewhere because it's random. Overall, I think it depends on the obfuscation strategy. It's true that having a unique @mydomain.com part is a big giveaway and someone could theoretically track one's activity by searching for all e-mail addresses coming from the domain. My use-case is more to use unique e-mail addresses to throw off credential stuffing attacks, not become untrackable/avoid all spam. For the tracking use-case I generally think several times if I want to register somewhere at all and try the usual routes first (mailinator, random old addresses on public e-mail).
mike_d 5y ago
What is Relay going to do when the domain ends up on one of the many "disposable email address" blocklists?
- Vinnl 5y ago
  We're actively reaching out to maintainers of such lists (see e.g. [1]) to get us removed, and take a number of measures to make that more palatable (see also [1]). And of course Relay is a bit different from services like Mailinator, where email addresses are usually actually single-use: Relay addresses remain active until their owner actively disables them. Possibly in the future it might also be possible to bring your own domain, but I don't think we have any concrete plans for that that we can share. That said, no solution is perfect, and I expect that there will likely always be situations where you will be forced to fall back to a regular email address. [1] https://github.com/wesbos/burner-email-providers/pull/339 https://github.com/wesbos/burner-email-providers/pull/339

by Vinnl 5y ago

VTimofeenko 5y ago

On the unguessability of other addresses - I rotate several schemas making the mask of the address something like [service].[username].$(pwgen -1 | tr '[:upper:]' '[:lower:]')@customdomain. Sometimes "[service]" is also shortened like "hackernews -> hn" to dodge the ban on service name in the e-mail address that some service providers apparently have.

Vinnl 5y ago
Ah, I don't necessarily mean guessability of which other addresses I use, but of how you can reach me. If I block yourservice@mydomain.com, you can still attempt to reach me at totallynotyourservice@mydomain.com and it will work. You'll also be able to link my different addresses on different services. If I throw away the Relay alias for your service, that's it - there's no way to lead that back to me anymore.
- VTimofeenko 5y ago
  Gotcha. > you can still attempt to reach me at totallynotyourservice@mydomain.com not if the catch-all address is actually /dev/null and the totallynotyourservice@ has to be mined from somewhere because it's random. Overall, I think it depends on the obfuscation strategy. It's true that having a unique @mydomain.com part is a big giveaway and someone could theoretically track one's activity by searching for all e-mail addresses coming from the domain. My use-case is more to use unique e-mail addresses to throw off credential stuffing attacks, not become untrackable/avoid all spam. For the tracking use-case I generally think several times if I want to register somewhere at all and try the usual routes first (mailinator, random old addresses on public e-mail).

mike_d 5y ago

What is Relay going to do when the domain ends up on one of the many "disposable email address" blocklists?

Vinnl 5y ago
We're actively reaching out to maintainers of such lists (see e.g. [1]) to get us removed, and take a number of measures to make that more palatable (see also [1]). And of course Relay is a bit different from services like Mailinator, where email addresses are usually actually single-use: Relay addresses remain active until their owner actively disables them. Possibly in the future it might also be possible to bring your own domain, but I don't think we have any concrete plans for that that we can share. That said, no solution is perfect, and I expect that there will likely always be situations where you will be forced to fall back to a regular email address. [1] https://github.com/wesbos/burner-email-providers/pull/339 https://github.com/wesbos/burner-email-providers/pull/339