7 ms·
The email address I give out to companies is theircompanyname@myserver.com - this has most of the privacy benefits the author describes. But frankly, I did it j
by hansword 4y ago
The email address I give out to companies is theircompanyname@myserver.com - this has most of the privacy benefits the author describes. But frankly, I did it just to find out who sells my personal info to spammers. Turns out quite a few do, and whenever I get a spam email, i just look at the to-address and I know who betrayed me.
Edit: multiple typos
- philipwhiuk 4y agoIt's not much better than "Your.Full.Name+company@example.com" in practice tho.
- samschooler 4y agoI'd say its one level beyond. Since "+" is so widely used, as talked about in the article, its trivial to remove. However with a non-standard domain and inconsistent username its not as easy to remove. These are some of the formats I use, they all offer exactly what I need (uniqueness, hard to programmatically attach to another, and culpability): lyft@account.example.com liftcarshare@example.com email@lyft.com.example.com example.com@com.lyft.example.com
- anonporridge 4y agoI would personally go one level further. Generate random email addresses so you can't easily guess what others I might have given out. Then keep track of the mapping. A service like simplelogin.io makes this easy.
- ZetaZero 4y agoFastMail does something like this. Their Masked Emails are two random words plus a four digit number.
- caust1c 4y agoBeen using this feature since they introduced it and can say that I'm very pleased with it so far in combination with it's 1password integration. When creating an account somewhere, fastmail automatically generates a new email for the site via an API in one click. Highly recommend.
- bosie 4y agoicloud and also fastmail do this for you
- sereguze 4y agoWhat about base58 encoding their company name.
- GoblinSlayer 4y agoCaesar cypher.
- turboponyy 4y agoWhat I usually do is servicename + 6 to 10 random numbers. This way I can see the intended recipient whilst avoiding people being able to check where I've signed up.
- t_mann 4y agoWhy not use the numbers to encode the creation date?
- turboponyy 4y agoYou certainly could, though I don't particularly care about the creation date - additionally, this is something that I can do easily by hand. E: Ah, I didn't see the schema one of the parent commenters suggested - your question makes a lot more sense now. I still don't really care about the creation date, though, but I do care about the email having a random component, since if someone were to figure out my naming schema, they could check whether I've signed up for any given service.
- t_mann 4y agoGreat idea with the subdomain! May I ask how you do it? Also, one idea for you: how about using created20220621@company.example.com?
- samschooler 4y agoFastmail allows for wildcat (J)IMAP addresses. It a *.example.com MAIL record in dns with a supported (J)IMAP server.
- pandemicsoul 4y agoLots of company don't allow you to enter the + symbol in their signup field.
- anonymousiam 4y agoI do this too, and lots of companies also don't allow you to use THEIR company name in the email address that you give them. Sometimes their front-end is not aware of this restriction and will let you register, but then you'll have unresolvable issues. I've spent some time on tech support phone calls with companies that have this issue. Occasionally a company will implement blocking their own name in a user-provided email after the user is already registered. I've had this happen a few times too. Suddenly the account will disappear without explanation.
- forgotpwd16 4y agoA spammer can just filter the +company bit out.
- prash_ant 4y agoYes, but the fraction of users using the +company part would be similar to the fraction of linux desktop users on the internet. The way we don't see most software companies supporting linux desktop users simply because it is not profitable, we can hypothesize that the spammers won't spend time-energy-money on getting the +company filtered out.
- remram 4y agoThis is common enough that many sign-up forms reject the +. Spammers can definitely do that much.
- indymike 4y agoRemoving the +company is not cool. When I give you myname+yourcompany@mydomain.something, I'm authorizing you to mail to that address, not myname@mydomain.something. If you don't respect the recipient, you'll be rewarded with unsubscribes, at best, and spam reports at worst.
- core-utility 4y agoBut we're talking about the same companies who will sell your data for a fraction of a cent. I don't think they care about being "not cool"
- paulryanrogers 4y agoIME some may accept the plus address at sign up then break it at sign in or substitute for another character. A major US insurance company did this, which could have allowed hijacking if one had registered the address with the plus replaced with their substitute character.
- samschooler 4y agoThis is what I do as well, and its real nice to be able to black hole a specific to email address vs trying to unsubscribe from every piece of spam email sent to your one email address.
- nazca 4y agoI do the same. In addition to the security and privacy benefits, the traceability have been helpful. Years ago my Netflix account was hacked, and they refused to believe it was on their end. They were sure someone had accessed my email. I was not able to convince them that netflix@myserver.com was not a thing you could log into. But having a unique email was one of the clues that led me to be confident that my email had not been hacked, and it must have been something purely on the netflix side.
- kolinko 4y agoPlaying devil's advocate - it could've been your Netflix password that was compromised, or someone you shared your Netflix password with (if you do it).
- davchana 4y agoI too do it, although occasionally an hickup occurs. Last week, I signed up for something, and their system was unable to send an account activation email at theirCompanyName@myDomain.com I spent about 30 minutes with customer service on chat, and they were like, no, it's impossible to have them@my domain email. If I have, I should send them an email. I did it, sent email, and they were still not believing it.
- LinuxBender 4y agoI used to keep it that simple but some companies are catching on and blocking the account in the name of "fraud" but really they are just upset. Instead I use a realistic looking canary that maps to their company without their company name being in the email address.
- indymike 4y agoCompanies that do not respect RFC email addresses are simply breaking the internet. Email addresses are not unilaterally specified by your marketing department, they are at this point, internet infrastructure. https://datatracker.ietf.org/doc/html/rfc5322 https://datatracker.ietf.org/doc/html/rfc5322
- LinuxBender 4y agoAgreed but I don't think they care about RFC's. Rather they want to be able to track people and be able to sell or leak, but really sell your email address and email canaries put a stop to that behavior and they don't like it.
- kevin_thibedeau 4y agoI spell their name backwards to thwart this filtering.
- justinlloyd 4y agoOh, you mean VMWare... one of their CSR's they did that to me.
- GoblinSlayer 4y agoYou can just spell it vwmare.
- core-utility 4y agoSame here. It's fun getting doctors offices coming back and asking me "Do we have your email right?"
- phyzome 4y agoI'm not sure I've ever found any indication of someone selling my address, but I've discovered multiple services that have been hacked. One of them, Avvo, has yet to admit it... but it's quite clear.
- spacedcowboy 4y agoTesla did it to me, because I have had the same approach as grandparent forever (well, for 30 or so years, anyway). Recently I had a text message to my phone number asking me if I wanted life insurance, and whether I preferred to be contacted at ‘tesla@<myserver.net>‘ or continue our conversation via text. I have plenty of life-insurance through my company… Funnily enough, Elon didn’t reply to my tweet asking him if this was standard Tesla policy… Never did like that rat-bastard.
- GoblinSlayer 4y agoWe should do something with phone numbers too.
- jmprspret 4y agoI do the same but I have never ever caught anybody selling my email to spam companies.
- Gigachad 4y agoSame. Did this for years and never found anything. Ended up going back to a single email address.
- t_mann 4y agoWhat tools do you use to create so many email addresses/aliases on the fly, and to keep a check on them?
- GoblinSlayer 4y agoAccount creation doesn't happen on the fly, does it?
- jabroni_salad 4y agoHere's my strategy with fastmail. I think it's the best: 1. I allow wildcards only on a subdomain. The friendly alias on the top level domain is only for real human beings I want to talk to, not robots or marketers. I don't allow cold messages to the subdomain into my inbox because of issues I've had with spammers in the past. 2. I use a random username as the address and store it in bitwarden. It isn't named after the company but I can match it there if I ever need to. Recently BW added a generator for this, but I was already doing it manually by freehanding on the keyboard. 3. Seive rules. I put newsletters in a reading list folder, receipts in a receipt folder, etc. Everything else sent to that subdomain gets sent to a purgatory folder that deletes anything older than 90 days, so I don't accumulate a bunch of garbage. If I am signing up for a newsletter that I don't care about enough to tune the rule, then I probably wasn't going to read it anyways. As a result I have not had a low value message reach a high value folder in probably 5 years. Skimming the folder I can see that Illinois politicians are still trading my address around even though I moved out of the state 4 years ago.