24 ms·

Tell HN: After 10 years of experiments, custom username emails receive no spam

• groffee 4y ago
  If they do sell the emails it'd be a simple job to clean them first (i.e remove any that explicitly mention their company name) Spammers are a pain in the ass, but not stupid.
• jack_riminton 4y ago
  A simpler way to do this is to append the company name to whatever gmail you're using e.g. if my email is bob@gmail.com you could use bob+amazon@gmail.com. No matter what you put after the '+' it'll still get sent to you
  • kibwen 4y ago
    The problem is that plenty of poorly-coded signup forms reject the plus character as invalid within an email address.
    • WithinReason 4y ago
      It's also easy to strip with a regex
• dspillett 4y ago
  I've been doing this for about two decades, and I've had to block a fair few addresses for spam over that time. In almost all cases with companies of any significant size/reputation it was entities that either publicly admitted or were publicly called out as having been hacked – so incompetence or the bad luck rather than deliberately selling my details on. In a few of cases (a couple of hosting providers, a physical-store electronics retailer) it has been a business that had failed before the spam started, so presumably their contacts were sold as an asset as part of the winding down. I give different addresses to any online forum too — they have seen a much higher rate of addresses needing to be dropped due to spam. If you use a catch-all address rather than setting up each alias individually then you may get “dictionary” attacks at some point. Early on when I used <varies-by-company-or-other>@domain.tld I saw that a few times, with someone sending to alan@, alana@, alvin@, … Since moving over to <varies-by-company-or-other>@sub.domain.tld (where “sub” is a static sub domain operating as catch-all, with only a whitelist of addresses on the main domain now accepted) I've not seen this again. I don't know if that is because name dictionary attacks like that are simply rare, are not attempted on more complex addresses, or never really worked so spammers don't use the technique at all any more. Where an address ends in a number, I've seen guesses that increment that number – so as well as getting junk to somecompany2@sub.domain.tld I get junk to somecompany3@sub.domain.tld and so on. I assume this is an address farmer bulking out their database. One place where passing on of your email address seems rife is kickstarter and indigogo projects. I'm on several mailing lists I've never subscribed to on those addresses, and another appears every couple of months — I don't know if it is the projects themselves or the survey management third parties that are to blame, I suppose I could test that by cycling the address but I'm not been bothered enough to make that effort. I have messages from those lists auto-filed into a folder, and if I'm tempted to support a project I search that folder first – if they have been carried by one of the spammy mailing lists I won't be giving them any of my money. I've saved money on three projects thus far with this. A petty victory perhaps, but I like my petty little victories!
• kloch 4y ago
  Another thing guaranteed to attract spam is a public contact email on a domain name.
  • deleted 4y ago
    [deleted]
• db48x 4y ago
  Email spam is the bottom of the barrel compared to tracking people on Facebook.
• lathiat 4y ago
  Depends if they get breached haveibeenpwned.com style. I definitely and clearly get spam from several breaches. Some is generic (it’s on some big spam list) and some of it is targeted - like crowd funding campaigns spamming the hacked list of kickstarter accounts - which I am surprised how much of I get given how community driven such things often but I guess are not always. Some of these addresses were the unique style you mentioned. So I guess you’re just lucky.
• OrangeMonkey 4y ago
  I'm glad you had a good experience. I had a different one. I've ran my own domain for longer than you have, and many emails have been compromised. Some are 100% from companies selling the emails to sister companies. The majority, though, is from a company itself being compromised by hackers / database access / etc. LinkedIn, Neopets, ProFlowers, TeeSpring, etc. I can go on.
  • bombcar 4y ago
    Compromises are 99% of those I see (similar setup) - the last 1% is acquired companies that have pivoted/do something else. It's not quite spam, it's not quite illegitimate, but it's not what I signed up for.
    • jawns 4y ago
      I've seen a shift. Between 2005-2010, I used [company]@[mydomain.com], and I noticed that I would get spam in the form of [gibberish]@[mydomain.com], presumably from spammers who were just targeting email addresses with a catch-call filter. In fact, around that time, my hosting provider, Dreamhost, started restricting email catch-alls to deal with this problem. But then from around 2010 onward, that type of spam became much less common, and nowadays it's as you say. The vast majority, probably 90%, come from compromised accounts, like linkedin@[mydomain.com]. The rest hit the unique email addresses I have submitted in domain registration forms. That's even more surprising considering that I've since shifted to using [username]+[company]@[mydomain.com]. Spammers could pretty easily strip off the `+[company]`, but I haven't seen that happen much.
      • bombcar 4y ago
        We've successfully pushed spam down hard enough that the only people spamming are people who never even see your email address; it's all computerized and they just don't care at all to try to do anything to clean up the lists.
      • stormbrew 4y ago
        The gibberish name ones may be targeting backscatter. They might have a reply-to with the address they're really targeting. And that may have dropped off because there was a concerted effort to make it harder to do that around then. In particular, that's kind of what killed qmail as an in-vogue MTA, because it wasn't being updated and you had to use awkward patches to stop backscatter.
• cassianoleal 4y ago
  I've been doing this for 2-3 years. Probably also in the hundreds of emails given. I have had one such email used for spam. Edit to add: I have no spam filters on those accounts.
• darkerside 4y ago
  Spam is just any unwanted email, and I'm sure you're receiving plenty of those. I assume what you haven't received are phishing emails with malicious links?
• magnat 4y ago
  After doing the same since 2003, out of ~200 email addresses used 18 are listed on HIBP, ~15 receive dozens of spam emails a day (or rather: would receive if I hadn't completely blocked them) and ~10 see almost non-stop login attempts from all around the world via IMAP and SMTP. Address linked with "mailto:" on a contact page had to be blocked after a few years. Same with WHOIS addresses (published before there were sane privacy rules for those). Address with "@" and "." replaced with "at" and "dot" receive no spam at all. Summed up, there are a few hundred inbound messages a day. Spamassassin and some basic postfix rules filters almost all of them. One or two a month get through.
• Raed667 4y ago
  I only have 2 addresses that receive spam: 1- An address I used for buying an RPi from a french retailer (kubii.fr) which seems to have had a data breach 2- An address I used at Decathlon when I signed up for 4x payment plan. They seem to share the address you use with Sofinco which keeps spamming me even after unsubscribing.
• bryankaplan 4y ago
  I too do this, yet I occasionally receive evidence that my address was sold or stolen. I've confronted one company about the problem, and they outright denied that they had any part in it.
• cornstalks 4y ago
  Most recently Chatbooks sold my email to some T-shirt companies. Or maybe they were pwnd. Either way, I wouldn’t call this a “modern myth.” You’re fortunate to be so spam-free.
• JoeAltmaier 4y ago
  Maybe its the spammers' filters that explain this? company@mydomain.com might be stripped from their mailing list because lots of folks do this. Me for instance.
• orev 4y ago
  I’ve been doing this for over 20 years, and have the same results. The only spam I get is to a few addresses where there was a data breach (LinkedIn). I have another account where I don’t do this, and it gets around a dozen messages per day from the completely illegal spammers (no opt-out, etc). However, it’s entirely possible I’m not seeing many messages that are getting blocked by spam controls (gmail), so I hesitate to draw any sweeping conclusions about it. I’m also very cautious about what I sign up for. I can say that from what I’ve seen with others, the amount of spam and phishing is very dependent on what you do. For example marketing people need to go widely distribute their addresses as part of their job, and I definitely see them receiving far more spam/phishing than others.
• huhtenberg 4y ago
  I've been doing this for over 10 years, but I do get spam on some of them. It comes in two forms. One is that companies subscribe to the marketing emails without asking. When this happens, they tend to re-offend on unsubscription, so they had to be blocked by blacklisting. The second form is that they do in fact share my email address with others. Not two months ago booked a hotel in Europe and got a spam from some other company before I got a booking confirmation. So this happens. That all said, the point of using per-company emails is less about spam and more about denying them an option of collating my online activity. The fact that you don't get spam doesn't mean your email address (+ relevant personal details) aren't getting resold, shared and otherwise vacuumed by the data collectors. That's them I more worried about than an occasional spam.
• nickhalfasleep 4y ago
  Donate to a political candidate or large non-profit. Those are where I see the most sharing of addresses. I have been doing the same sort of custom emails.
  • reaperducer 4y ago
    Donate to a political candidate or large non-profit Can confirm. Joined an art museum in a major city. Within a month, the unique e-mail address was getting spam from the aquarium, the science museum, the local PBS television station, and some museums I never even knew existed.
  • cheeze 4y ago
    Seriously. Donate to planned parenthood once and you basically ensure that the company spends more over the next 10 years bothering you than your donation was worth. And I like PP but goddamn, emails coming from a swath of domains, a neverending stream of physical mail. I won't donate to them again because the amount of contact they try to have with me is absurd.
    • 8organicbits 4y ago
      Huh, I donated about a year back and, while I think I did get some messages, I unsubscribed and haven't seen any since. How long ago was your donation?
  • marcinzm 4y ago
    Yup, one donation and I get a never ending stream of different political campaigns messaging me. Unsubscribe from one and a different one emails me the next day. Marking them all as spam seems to be helping more than unsubscribing.
  • sbf501 4y ago
    I should have specified that it was only retail, not social media or politics.
• mynegation 4y ago
  I do this and I definitely get spam to addresses associated with e-mails leaked or sold in bulk to the highest bidder. I rarely _see_ it as most of the time "unsubscribe" link works (for sold e-mail lists, as the buyers usually try to maintain some sort of decency) and for those where it is useless (shameless "enlargement" type emails, usually from stolen email databases) it is usually classified correctly as spam by an e-mail provider or e-mail client. So, I never had to explicitly filter e-mails out by "To:" field, but using this system still gives me some sense of control.
• gpm 4y ago
  Maybe not 3rd party spam, but definitely first party spam. I gave a custom username email to a in-person store (big chain) with a rewards program because they were offering a huge discount if you did. Since then they've sent at least 1 email a day, with an average of about two (I've redirected all their emails to a folder I never look at). Which is a particularly remarkably obnoxious rate of sending emails... I've also split my email addresses in to a public one (displayed in my profile here, on github, on a website, etc) and a private one. The public one gets a spam email or two a week. Incidentally, I was surprised to discover that pinterest forbids you from having the word pinterest in your email (or did when I signed up).
  • sbf501 4y ago
    I wasn't counting 1st party spam as spam because in many cases I like the information I get (usually sales on things I buy). I should have pointed that out in my post. Thanks for making the distinction.
  • fckgw 4y ago
    So just unsubscribe from the mailing list then? Why are you setting up these custom filters instead of just clicking the link and opting out?
    • happyopossum 4y ago
      > So just unsubscribe from the mailing list then? I've encountered many companies that let you unsubscribe, then add you to a 'new' mailing list a few months later. You can usually identify these companies because when you click to unsubscribe they take you to a page with a dozen or more 'newsletters' that you have to uncheck to remove yourself from if you can't find the 'all' link.
      • Groxx 4y ago
        Unsubscribe also frequently doesn't carry over when a company is sold to another, who then harvests every email ever mentioned anywhere to send new spam to.
    • 4y ago
• patio11 4y ago
  As an additional datapoint, my main email address is publicly available (I obfuscate it when typing out of anti-spam research force-of-habit but it's all over the Internet, public records, people's inboxes, company customer lists, etc etc), in continuous use for 15+ years, and I receive less than a handful of spam per week, almost all of the "Hello owner of $DOMAIN would you like you buy our SEO/etc services" genre rather than garden-variety spam. Possible confounding factor: I try to keep my personal and professional lives ~separate and so the retailers/etc most likely to be compromised get a personal email address (whose inbox is virtually unusable due to amount of commercial email it receives, though relatively little of that is spam per se).
• avnigo 4y ago
  It's not just companies selling your email address to third parties, it's also companies that keep your email on file and then get compromised. Most of the spam/phishing I get is from companies that stored my personal details and then got hacked. I would say it's likely you just got lucky.
• Elof 4y ago
  What email service are you using?
• btrettel 4y ago
  I think spam to email addresses found in data breaches is more likely. An address I used only for Comcast Xfinity gets a surprisingly large amount of spam. (I'm no longer a customer and have disabled the address.) I'm not the only one to suspect they've had a data breach: https://news.ycombinator.com/item?id=30062511 https://news.ycombinator.com/item?id=30062511 https://news.ycombinator.com/item?id=30980625 https://news.ycombinator.com/item?id=30980625 https://news.ycombinator.com/item?id=31118355 https://news.ycombinator.com/item?id=31118355
• bergenty 4y ago
  I have no spam on my gmail account. All I do is every time some new spam shows up I immediately unsubscribe. I might get new spam maybe once a month but that’s easy to unsubscribe from.
• frou_dh 4y ago
• LinuxBender 4y ago
  Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good? Email databases for sale are not always for spam or malware. They are often used for tracking and cross marketing calculations. Placing a companies name in the address will signal a canary and they may likely filter your contact out of their database or at least flag it and treat it differently. I've been using email canaries for decades but recently had to adjust my canaries to be less obvious. A few vendors got upset that I had their name in the address and one even accused me of fraud and canceled my $500 gift card. That was the Tractor Supply Company. Either way I will continue using canaries and multiple domains as it is a good way to be filtered out of some cross marketing databases and to avoid some behavioral tracking and some machine learning. It is also useful to find companies that get upset. This is an indicator to me they lack integrity and should be avoided. Canaries are also a good indicator to detect if a company has been compromised.
  • nibbleshifter 4y ago
    > A few vendors got upset that I had their name in the address I have had this happen a few times. > Canaries are also a good indicator to detect if a company has been compromised. Yep, this is a fantastic use case.
    • adamfeldman 4y ago
      This is exactly my use-case and experience after many years of custom catch-all'ing. I've noticed a couple breaches, and also a few unexpected transfers of my email address between semi-related parties. Just once it appeared an address was sold via a marketing list, after filling out a lead-form for a free online conference hosted by multiple companies that you've seen on HN. Surprisingly, unsubscribing tends to stop emails from everyone.
      • f4c39012 4y ago
        Slightly easier* than running a domain, i've had luck with myemail+CompanyX@gmail.com when signing up to CompanyX. Gmail handles the '+' transparently (in the same way as it ignores '.') and delivers the email to myemail@gmail.com. It is fun to receive a survey about "an anonymous company you have used in the past"... sent to myemail+uber@gmail.com. *yet less reliable, '+' in email addresses isn't always accepted, and when it is sometimes only partly, e.g. signup works but password reset doesn't
• asciimov 4y ago
  The vast majority of my spam comes from the bad old days of desktop pc viruses and people using outlook express (say 15+ years ago). Back then, my college required us to forward our university email to a personal account. That's fine as our personal addresses were hidden and not public. What was not fine was one day the IT department changed everyone's public email address to their private address. They also changed mailing lists from BCC to CC so that you got to see everyone's email who received the email. A few hours later after these changes, the spam started rolling in. At first it was a moderate amount of spam, a few messages a day, but it quickly increased. At one point it was up to 200-300 spam messages a day and stayed that way for several years. In any given month my gmail spam count sat between 3,000 to 6,000. Over the past 10 years, as botnets have been taken down, those numbers have come down an order of magnitude. I still get between 20 - 30 spam messages a day on that account.
• bityard 4y ago
  I have been doing the same thing, for about the same amount of time. The only "actual" spam I ever get are for email addresses where the marketplace has shared my email address with the seller. Ebay, especially. I have to rotate my ebay email address periodically and block the old one in order to keep the spam down to a reasonable level. However, I still use custom email addresses when signing up with various companies/services because the trend over the last five years has been for every company (large and small) to automatically subscribe you to their asinine daily newsletters and other marketing crap even when you specifically opted-out on signup. Yes, the emails themselves _usually_ have unsubscribe links, but those only have a 50% success rate in my experience. And this is from otherwise reputable companies. Easiest to just block the whole email address and move on with my day.
• bitexploder 4y ago
  Try having common firstname.lastname@gmail.com and using that address for a decade+, the spam is a constant deluge that very often gets by the spam filters.
• spiffytech 4y ago
  > Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good? A decade ago I worked for a service that let you send bulk emails. Any time we thought a customer was using a purchased email list, we came down on them hard or booted them off the platform. Same for other forms of spamming, not including an unsubscribe link, etc. This wasn't necessarily altruistic: if their emails were marked as spam it would poison the reputation of our sending IPs and threaten the business. It's clearly imperfect, but the industry's incentives seem to help.
• dhosek 4y ago
  My biggest spam vector is an email address that is old enough that I used it on usenet back in the day. Pretty much any email that was used on email ended up in every spam mailing list.
• dhosek 4y ago
  Having your email in a mailto: link is no longer the spam vector that it used to be. I’ve had my writing email posted as such on my website for over a decade and it gets no more than one spam per week and those are all caught by the gmail filter.
• luminousbit 4y ago
  I too have done this for almost years and it's magical. So easy to see who has been compromised. Also a great protection against phishing because "You need to update your Capital One password" that isn't addressed to "capitalone@mydomain.com" is an instant red flag.
  • bdamm 4y ago
    I've been doing it for 20 years. Yes, or conversely, seeing "You need to update your Capital One password" being sent to my custom addresses for AAA, Telecom, Linkedin, etc.
• bravetraveler 4y ago
  Meanwhile I do basically the same thing (different provider) I could (and should) shame at least a dozen decently well-known organizations, just ridiculously low on my list to go digging again. Surely partly due to filters, but also our activities/circles - and the control over their data. A lot of compromises lead to leaked lists of addresses to both spam and target for gaining access
• dickfickling 4y ago
  I've been doing the same (also for about 10 years). A quick scan of my spam folder from the last few days shows drizly@, eventbrite@, homechef@, and sunany@ were all leaked at some point.
• ryanlitalien 4y ago
  I use an alternate spam filter process. I use a "+" sign in my gmail address. So I would subscribe to a promotion/giveaway with username+company@gmail.com. This is a great way to catch which promotion/company sells your email address to unwanted companies. Caveat, sometimes an unsubscribe website can't handle the "+" symbol in an email and you'll continue to get spam. So, just add a filter for that "TO" email to forward to the spam/trash folder.
  • btkthrowaway1 4y ago
    What's stopping websites from just removing '+company' from 'username+company@gmail.com' and emailing you at 'username@gmail.com'? Even if the website you provide it to doesn't do that. Anyone who buys it can. I'm guessing the answer is, "Most companies are too lazy", but that seems like a weak behavior to depend on.
    • denton-scratch 4y ago
      My guess is that they're too dumb to send marketing emails to people who are obviously taking trouble to NOT receicve marketing emails. Sending emails to everyone on the planet is one thing; but taking pains to send emails to people who are clearly trying to dodge them seems terminally stupid, and I'd fire anyone who was trying to spend my money on an effort like that.
    • ryanlitalien 4y ago
      From having experience in email marketing, I highly doubt companies are editing email addresses before send. But you are right though, I have had signups that denied the "+" via JS.
• bjourne 4y ago
  Given your results it certainly seems so. However, I know of quite a few companies who required people to sign up with their email addresses to play their free games and then sold their addresses to marketers. Perhaps you wouldn't count that as spam since the emails sent had some substance? Or perhaps you only reveal your email to trustworthy sites and not to free gaming sites and such?
• taway2022-08-15 4y ago
  I use [company]@[mydomain] when signing up for things. So far the only offender is a porn site I paid for for a while. I was getting weird scam emails sent to that address daily, with text like "Hi [name of site], How are things? Is this your new email?". Surprisingly, when I cancelled my subscription, the scam emails stopped.
• johnklos 4y ago
  Let's consider a few things: 1) Just because it hasn't happened to you, that doesn't mean it doesn't happen. I have quite a few examples of companies selling or otherwise sharing, whether intentionally or through compromise, my email addresses. 2) If someone (some company) is going to sell email addresses, it's not unreasonable to imagine that they'd want to remove any addresses that would directly link those addresses to their source, so a quick search to remove any address with the word "adobe" in it when selling Adobe mailing lists would not be unexpected in the least. Years ago I set out to learn more about the "missing sock" problem (https://en.wikipedia.org/wiki/Missing_sock https://en.wikipedia.org/wiki/Missing_sock). I bought a dozen pair of brand new socks and I ironed on labels identifying each and every sock. Guess what? The labeled socks never went missing. The act of labeling the socks dramatically affected the experiment. Perhaps using companies' names in our email addresses is affecting our results.
  • deleted 4y ago
    [deleted]
  • infogulch 4y ago
    > remove any address with the word "adobe" in it when selling Adobe mailing lists That's a good explanation.
  • conor_f 4y ago
    For point 2, at least it's a form of personal protection? Sufficient a reason for me to use it if I'd be excluded from leaks.
  • wildrhythms 4y ago
    I wonder if OP's custom domain is making it "not valuable" for sale. Consider a buyer only interested in collecting Gmail addresses.
• suzzer99 4y ago
  I do the same thing. I've received span on a a few. Interestingly Gary Johnson (the Libertarian candidate for president) sold my email to Scott Walker (the right-wing Wisconsin governor). That shows you something. Also my United Airlines email got out there in the spam world. I think there were a few others. I finally stopped doing it out of laziness.
• gigel82 4y ago
  FWIW, I've been running a similar experiment (granted, for only 2 years) only instead of specifying the company name I'm using a random term (e.g. purplerabbit@domain.com) and found similar results. No 3rd party spam thus far (though I found a few companies that continue to send marketing materials, etc. even after using all available unsubscribe options).
• vinay_ys 4y ago
  Email is a lot less valuable these days, exactly because of how good the spam/categorization filters have become – huge kudos to gmail for this. Phone number on the other hand – it is a nightmare – how every service (office front desk, apartment front desk, car wash, restaurant, barbershop etc) takes your phone number and uploads it to some spam database and then you get so many spam sms and calls.
• leephillips 4y ago
  I use a catchall as well and can confirm your experience. No spam from one-off addresses given to companies.
• jonathankoren 4y ago
  Ironically, my "spam-magnet" email doesn't get spam, but my "official" email gets tons of spam. It started out with people that bought my email address specifically to spam a different person with my name. Now I also get generic spam, probably as a result of scraping it from my pdf resume.
• that_guy_iain 4y ago
  I did the same thing. I noticed that every now and then some dodgy site would sell on the email and I would get spam from those for a year or so. Then they would stop emailing those emails.
• wiredfool 4y ago
  I've definitely had spam to some of mine -- Especially t-mobile after they had a compromize some years back.
  • Minor49er 4y ago
    Same here. What's funny is that T-Mobile announced that they were going to use a McAfee anti-phishing solution to compensate for the breach. So the thieves who got a hold of the customer data have been using that to target customers with their real names through email, giving them fake invoices for "McAfee services" and links to where they can make payments
• nuker 4y ago
  Disabling “Load Remote Content” setting in email clients seems to reduce spam too.
• mkl95 4y ago
  I have regularly used two gmail accounts for 13+ years. One of them receives tons of spam every day and has two dozen haveibeenpwned entries. The other one receives little spam and has no haveibeenpwned entries.
• TT-392 4y ago
  You should try signing up for a few chinese pcb manifacturers, your email will end up all over the place.
• js2 4y ago
  Just don’t ever donate to a non-profit or political campaign. There is no unsubscribing, ever. I mean, they have unsubscribe links, but those don’t actually do anything AFAICT. You also can’t stop them from sending you postal mail. Fortunately non-profits and politicians are lazy and they all use just a few emailers which you can identify via the headers, so a couple Fastmail rules catch most of it. NGP VAN is the worst offender on the Democratic side, and can be identified by “Return-Path:” contains “bounce.myngp.com”.
• aspyct 4y ago
  I also use email aliases to identify companies who sell my data. A few did it, and keep doing it, despite my many complaints. Definitely will continue doing so.
• numbers 4y ago
  can I ask how you did the custom emails, did you use a password manager to keep track? I have been doing this recently (in the last year) and I'm very happy to see a post about this!
• MrPatan 4y ago
  Similar experience here, although I have only been doing it for about a year or two. I have received exactly one spam email where I could identify who sold the db (or maybe it was leaked and they haven't owned up yet). Most of the spam I receive is to an address I used before that leaked in some hack a while ago, so that one is truly for sale everywhere at this point.
• swyx 4y ago
  i think the last time this discussion came up on HN, the conclusion was similar: https://news.ycombinator.com/item?id=30491518 https://news.ycombinator.com/item?id=30491518 they're not really spam sources but the other criticisms of email tracking/cross marketing apply.
• dima55 4y ago
  It happens sometimes. Most recently, an email address I supplied for a dog-dna testing service I used almost 10 years ago (https://www.wisdompanel.com/ https://www.wisdompanel.com/) received spam about some unrelated service called "okta"
• bambax 4y ago
  I do the same and it's true that those receive little spam. Not zero however; I just received minutes ago spam that was sent to britishairways@<mycompany> for example. The bigest spam magnet is the email address one leaves with a registrar; that is horrible. Then come contact@, webmaster@, and other generic accounts that spammers can guess for each domain.
• vultour 4y ago
  I get spam on three emails: public one listed on a website (obfuscated by JS), one that got accidentally published on a WHOIS record, and the one I use for recruiters & career websites.
• happyopossum 4y ago
  I've been doing the same for so long I can't even remember when I started. Yes, I do get spam to some of those emails, and yes, it is nice to block them. That said, the thing that's kept me doing this so long is this: on two occasions, an address given to a financial institution started getting spam - clearly they were hacked or had an internal user selling emails (I remember when that was worth good money - I doubt it is anymore). It was an early warning for me to change my password at that bank (this was pre-2fa), so the practice has kinda stuck with me.
• throwaway67743 4y ago
  This happens time and time again, enumeration, outright breaches etc - I've used aliases for as long as I can remember (2 decades maybe) and it's always the people you least expect - probably the most annoying one is where an azure specific alias was somehow enumerated and gets nonsense daily, mailgun also had an unacknowledged problem where you could enumerate domains during verification. These days I'm moving to a completely randomized not human memorable model, because often the obvious aliases are also tried. Incidentally I don't think I've ever had aliases shared they're typically just harvested as part of breaches or incompetence.
• user3939382 4y ago
  I’ve been doing the same thing for 5 years and the only problem I’ve had is people scraping my email from LinkedIn.
• tolmasky 4y ago
  Do any password managers support you having your own email domain and automatically creating an email address when you create a new account (ideally not just using the company’s name but something random perhaps to not give this away)? Like in a sign up form it could generate “helloworld99@domain.com” as well as a password.
  • throwaway67743 4y ago
    This is a good idea and something I've been looking into, it should be easy enough to do but I'm not sure you can hook things like auto fill in browsers and I'd imagine it could be easily abused (that is, trigger on another extensions auto fill) I actually have a service in the works that has a simple API to create aliases etc, with hosted imap though not forwarding because forwarding is stupid. The main issue though is by itself it's not useful, it needs browser integration etc
  • cimnine 4y ago
    Afaik 1password together with Fastmail, see https://1password.com/fastmail/ https://1password.com/fastmail/ or https://www.fastmail.com/1password/ https://www.fastmail.com/1password/, respectively.
• bennyp101 4y ago
  I’ve noticed the same, I wonder if they filter out emails that contain the company name when selling lists? I do often get asked if I work for said company when giving it in person or over the phone, and I just say it’s so I know if it gets sold or leaked I know where it came from. I seem to remember a few years ago I couldn’t sign up to a service with the company name in the email, but that’s the only time I came across that.
• withzombies 4y ago
  I wrote a blog post[1] about my experiences with custom usernames and how I regret it. It was previously covered on HN here[2]. I came to the same conclusion as you, but additionally decided it has been a major waste of time and I'm slowly trying to undo it [1] https://www.notcheckmark.com/2022/06/catch-all-domain/ https://www.notcheckmark.com/2022/06/catch-all-domain/ [2] https://news.ycombinator.com/item?id=31585463 https://news.ycombinator.com/item?id=31585463
  • sbf501 4y ago
    This is exactly my experience. Had I seen your HN post I wouldn't have bothered, because you've summed it up nicely. Especially the looks of disbelief I get when I say my email is their company name. Did it at a pet store recently and the cashier said to me: "You don't have to give me a fake email, just say you don't want to give me your email." There's no real need to undo it now, however. It is more of after thought. (I also didn't realize that I now must own this domain FOREVER because if I sell it, the next owner will have all of my email addresses for password resets.)
• IanNorris 4y ago
  I've been doing this for about 5 years. So far none of my company specific email addresses have been leaked, but it has let me black hole some emails (eg Intel) because their unsubscribe systems are broken. I wish I'd been more aggressive at switching to it as the one account I got the most spam from was Kickstarter when they got compromised. I'd say 70% of all my spam came from that one breach. That unfortunately was an email address I can't burn. I use SimpleLogin.io now after hand rolling a solution for a few years after I saw it linked from a HN post. The caveat is that my family members that hang off one of my domains struggle to understand it, despite them only seeing the personal Gmail account I created to receive their email to.
  • kwanbix 4y ago
    I also do this and my emails appeared on DB breaches so I got spam there.
• duncan_idaho 4y ago
  Another anecdote, but after visiting https://apiworld.co/ https://apiworld.co/ conference I receive a couple spam software sales emails a day. I unsubscribed to all of them for awhile but still get them years later.
• croes 4y ago
  I do the same and on some I get spam
• noizz 4y ago
  I have similar experiences in general, however I've been unlucky enough to be a victim of a couple of leaks like Adobe, Invision and Gfycat. Some marketplace retailers also leaked my email and couple of smaller stores too. Totally worth to know this. That said - my general info@ email that's semi publicly (simple js obfuscation) available on the website is orders of magnitude more spammed than those leaked ones.
• waspight 4y ago
  Isn't using company@mydomain.com a clear indicator that there is a catch all adress on @mydomain.com? Which makes it even harder to avoid spam once it is obvious that you can send to whichever email you want on that domain?
• legitster 4y ago
  I work as an administrator to an email marketing server. I'd like to think I can speak on some authority on this subject. > Is the fear of "people selling your email to spammers" a modern myth 100% absolutely. Your email address itself is not valuable or interesting in any way. I can't imagine there being an internet black market for random email addresses, but if I had to guess what they would be worth, it would be fractions of a fraction of a cent per email. Meanwhile, Mailchimp charges ~$0.02 per month for every email contact you hold onto. It makes absolutely no financial sense for your average retailer or newsletter to be selling your email addresses. However, your contact information might get sold if it is attached to high value sales activities. Like if you signed up for a quote on a $50k HVAC system or indicate you are a big donor to certain political causes. Your email address/phone number are valuable in that they are now attached to some pretty valuable purchasing intent. This is where less than scrupulous sites will live to harvest your data. This is still a bit of an outlier activity. If I sell expensive HVAC systems, the only people interested in this data would be direct competitors. If the information is actually valuable, it will be less likely to be widely disseminated.
• georgyo 4y ago
  This is not my experience, I too have been doing this for 10 years. In my experience, I got tons of spam, especially after a leak. By far, the _most_ spam I get to is get to government agencies and medical facilities. I started getting male enhancement messages to my parknyc (NYC parking meters) address in under a week after registering. Since my addresses are never used for more than one service, I can be reasonable sure they had a leak of some sort, but it is also not suffice evidence to actually report it.
  • seanp2k2 4y ago
    I've had CCs stolen because DMV + FasTrak required CC info and can't use PayPal. PayPal / Shop are great because they don't share your actual CC info with the merchant, only a one-time token for that specific transaction. All credit cards should work this way, where you'd log into your bank or 2FA with your bank (or Visa / MasterCard) and they'd provide the merchant with an auth code or something just for that transaction for that invoice to that merchant, instead of giving them the keys to the actual card. They even do have something called "Visa Secure" and "Mastercard Identity Check" ( see https://stripe.com/guides/3d-secure-2 https://stripe.com/guides/3d-secure-2 ) but I've never seen this come up in practice. I guess it's easier for them to just let merchants assume the fraud risk. We need some laws that put the burden on the card issuers to get them to actually care about CC fraud, but obviously the ones benefiting from the current system are very well-funded and have lots of sway with lawmakers.
    • spxd 4y ago
      All European credit and debit cards have a 2FA enabled. You cannot pay online without authorization from (bank) app.
    • muttled 4y ago
      My Capital One card has virtual card numbers you can generate and you can kill them whenever you need to (or have them only work once). I use them any time I'm buying something outside the major markets like Amazon.
• JadoJodo 4y ago
  I've been doing this for a few years (first manually, now via FastMail's MaskedEmail feature) with good success. The only issues I've had are when one service gives the address allocated to them to another, related service. An example of this that recently occurred was when a service I wanted to use only offered GitHub SSO. That service was then handed my GitHub-only email address. I've had the same thing happen at Kickstarter. Overall a win, but still annoying.
• greenail 4y ago
  The problem is not bad intentions or selling your information. The problem is that they copy it into a DB and it is a globally unique identifier. Once this happens you have lost control. You can never ungive that GUID. Your only recourse becomes spam filtering or migrating to another email GUID and waiting until the new one gets leaked all over the intarwebs and then doing it again. Phone numbers are even worse. The solution is fairly simple, as discovered by the OP. Don't give out the same GUIDs when you sign up for an online "relationship". It is a shame this pattern exists, people should stop designing accounts like this.
• butz 4y ago
  One sure way to start getting spam with ANY email, is to publish an application on Google Play Store. You'll start getting emails not only from advertising offers, shady SDKs, or Android development, but event for unrelated products from China.
• asdff 4y ago
  I'm legitmately baffled by this but thats because its not an actual experiment. You've limited your sample collection to retailers you in particular shop at. They could genuinely be good companies that aren't uncrupulous with your email. Meanwhile, I have no public website and no mailto: links for robots to crawl, yet I get plenty of spam I have no reason to ever receive. For example just looking at my gmail junk mail now I have a message from "ADT security" but coming from this email address which is obviously not their domain: adt45444@vne6bziks1jt25.w1123-4293.norelaut.us
• giancarlostoro 4y ago
  What does your email setup look like stack wise btw? Always curious to hear from people who are hosting their own email server.
• purpleblue 4y ago
  I signed up for a magazine subscription, and was added to a ton of spam email offers. So maybe not retailers but there are plenty of businesses that will sell your email. Charities are another good example, they make a lot of their money selling their donor lists.
• henpa 4y ago
  I have the same setup since forever but I do occasionally find one of the custom emails being used as SPAM (when this happens, I either delete it or replace with a new one). So it's very clear to me that those companies in specific either sold or had it's data stolen somehow.
• fxtentacle 4y ago
  I did the same. The one I used for my Adobe Creative Cloud subscription was drowning in spam.
• indus 4y ago
  There is another folder for those custom emails: Promotions. Gmail does a pretty good job of categorization.
• TonyTrapp 4y ago
  Where I'm getting (or rather was getting) spam, apart from my main address: - My Kickstarter address (well-known leak). - My Paypal address (probably leaked through a web shop). Both email addresses have been blocked since then. I also got a spam mail through one address I used for a forum, though the forum owner denied that they were ever hacked, and it stayed at that one single mail, so... not sure what happened there. So yeah, it does happen, and when it happens it's nice being able to just block that address completely within seconds and use a new one.
• codezero 4y ago
  I do the same, and so far I've had two leak through: 1. keen.io when they sold to a PE firm 2. 1password - we're not sure why this one happened, 1password's security team worked with me to dig into it and it's likely that the name I used was just too generic and landed on a keyword list.
• __david__ 4y ago
  I've been doing a similar thing and I do occasionally see things. I've recently been getting spam from my Mackie email, for instance—They were either compromised or sold off their email list. More often I've had to directly block companies whose unsubscribe links just wouldn't work. I have a very low tolerance for that—If I unsubscribe I mean it.
• byteflip 4y ago
  Been using Hide My Email from Apple’s iCloud and I’ve been really loving it! Semi permanent fake addresses ending in @icloud.com that forward to my gmail address. Apple is also one of the few companies I’d probably trust to the task. Wish it was a standalone app rather than buried in the settings menu.
  • josephb 4y ago
    I also wish they had a standalone app to help manage the addresses. Like so many of their good features, eg password management, it can be a bit too hidden for those up us who want some control!
  • wonderbore 4y ago
    > Wish it was a standalone app rather than buried in the settings menu. I could say the same about Passwords. I'm happy that they * finally * got passwords out of that relic called Keychain Access and into the System Preferences, but they could do even more. I hope to see an actual "online security" center on iOS and macOS within 2 years, with passwords, temporary emails, even learning material.
• bondolo 4y ago
  I do the same but regularly get spam. I just got a spam email today for automobile insurance and the source was an automotive buying company I used about a month ago. The businesses don't appear to be related in any way. The strangest one ever was an email address given to a boutique spa hotel in Oregon showing up on spam announcing a new production from a local California community musical theatre. I must have given the hotel my zipcode as well so the email was sold based upon my location.
• kuon 4y ago
  I think it might be related to the loading of remote image / tracking pixel, but since I started using mutt, my spam has been reduced by about 30%. I don't think I have changed anything else.
• joelesler 4y ago
  my email address is very guessable. I've been using iCloud's anonymous email feature since it rolled out a couple versions of MacOS ago, and my spam has decreased dramatically.
• eganist 4y ago
  I've received spam to seven different addresses, all of which followed breaches which were previously or later publicized. Just adding a sample.
• jen729w 4y ago
  There’s a single reason that I gave up on this method: having to send outbound mail to these companies. You sign up for a health plan using healthplan@example.com. Great, until you need to send them a document. You send it from myrealaddress@example.com, and they write back and say hey, that’s not the account on file, etc. So now you have to set up healthplan@example.com, configure it in your mail client, etc. And now you have this long list of special addresses to remember to have to send from, depending on the situation. Email is already something I loathe. Why would I make it harder on myself?
  • cdubzzz 4y ago
    Depends on your setup I suppose. I use FastMail for this purpose and it both automatically sets the `From` based on the `To` of the email I'm responding to and allows me to click in to the `From` email and type in whatever I want for the local part before sending.
    • jen729w 4y ago
      Ah that’s cool. I don’t think it did that when I used them, and I use Mail.app anyway.
  • mikeiz404 4y ago
    Email alias services can make this process a little easier, though certainly not painless, by letting you create reverse sending email addresses [1]. 1: https://simplelogin.io/docs/getting-started/reverse-alias/ https://simplelogin.io/docs/getting-started/reverse-alias/
  • Normal_gaussian 4y ago
    Fastmail allows sending from any address, the client supports it easily. There is also a few self-hostable mail clients that allow it. Historically I used a more convoluted method. When I used to use migadu (dont use them) I had a little script that would check the first line of any email I sent myself for a target email and resend it from the receive address. It was janky but worked.
• megous 4y ago
  I never had any spam come to my =@domain email address, despite being scrapeable on the web. ;)
• EVa5I7bHFq9mnYK 4y ago
  Not a myth. 20 years on, still receiving spam to an email address I used to order a male enhancement product.
  • reaperducer 4y ago
    still receiving spam to an email address I used to order a male enhancement product Encyclopedia Britannica?
    • EVa5I7bHFq9mnYK 4y ago
      Those were sold in physical form, no email required)
• trepatudo 4y ago
  I actually also do this and get into funny episodes because people think I work for the company when giving out the email address in physical stores. One time I actually got my phone fixed faster because the receptionist thought I was Samsung worker (samsung@m.....pt) and their store were Samsung partners. Anyway, I also do not receive any spam on the custom ones.
• Normal_gaussian 4y ago
  People that have sold my account immediately: - my last lettings agency. Lettings agencies are scum. People that have been compromised: - an aws account (!) - local city council I use a <service>.<date>.<nonce>@<domain> setup, the nonce has only protected from various colleagues being major PITAs.
• mehlmao 4y ago
  After Robinhood's data breach, I get tons of cryptocurrency-related phishing emails sent to "robinhood@mydomain.com". I've had a few other vendors sell / lose my email, such as an escape room in another city.
• TheChaplain 4y ago
  I have. Signed up at MyFitnessPal with a unique handcrafted address (alias), ended up getting spam a few months later (and still do, several years later). Confronted them about it and got accused of being sloppy and hacked... I am certainly not the smartest person alive, but I'm not a complete clown.
• core-utility 4y ago
  I definitely get spam at special addresses. Minted (data breach) is one, and another company sold my info for similar interests.
• xwowsersx 4y ago
  I use fastmail and I have created many aliases. Some in order to avoid spam, others to help organize my inbox. One of my aliases was clearly compromised and it is now sent a lot of spam. Do I simply delete the alias and retire it and update my email with whatever services I care to hear from? As an aside, I have found the spam filter on Fastmail to be pretty bad. Anyone else have this experience?
  • rascul 4y ago
    > others to help organize my inbox This is a big one for me. Some companies will send me mails from a bunch of different email addresses, sometimes with different domains. So much easier to have one rule for one of my email addresses than a bunch of rules for a bunch of theirs that I don't even know of yet.
    • xwowsersx 4y ago
      Right, exactly. Aliases are unlimited so I err on the side of creating too many rather than having too few.
  • microtonal 4y ago
    As an aside, I have found the spam filter on Fastmail to be pretty bad. Anyone else have this experience? Same. I love Fastmail, but even after almost a decade of training, spam filtering is quite bad compared to eg. Google Mail.
    • MerelyMortal 4y ago
      I have Fastmail fetch email from my Gmail inbox. Spam that clears Gmail's filter and lands in my inbox, that Fastmail then retreives, ends up in my Fastmail spam folder. Fastmail catches what Gmail does not in my case. Though the reverse has not been tested.
    • xwowsersx 4y ago
      Totally, I think I forgot how big of a deal Gmail's spam filtering was especially when it first came on the scene. I remember now :)
• 1in1010 4y ago
  If you can program rules into your email server, you can easily just ignore anything to company@mydomain.com that does not originate from something@company.com
• 1in1010 4y ago
  You can program your email server to simply drop anything to company@myDomain.com that does not originate from company.com
• lucb1e 4y ago
  Catch-alls are fun. Sometimes when I delete and purge an account somewhere (digitalocean for example, the checkbox is literally called 'purge'), all they do is change the user part of the email address: me@example.org -> _me@example.org. "Yup now the account is deleted, we hope to see you again soon!" It's too bad the GDPR authority in the Netherlands is much too swamped to care about a literal purge option doing literally nothing. In both instances, I was still able to login to the account with the original password (clearly not information necessary for tax record reasons, or whatever excuse they might come up with). I don't always check the developer console for the API response that might hint at this, and don't delete accounts that often to begin with, so it wouldn't even surprise me if a majority of services turned out to do something similar under the hood. Screenshot: https://snipboard.io/Y2MpbU.jpg https://snipboard.io/Y2MpbU.jpg (DigitalOcean's account deletion page, this is the option I checked but was still able to log in. The other offender, I don't want to even give the benefit of free negative publicity.) --- Catch-alls are fun. Sometimes when I email a company, like Contoso@mydomain.example.org, I will subsequently receive business email from their vendor (helpdesk or IT or whatever service they provide that made my email end up in the autocomplete) that was intended for their contact person at Contoso. I've always let them know but it feels rather awkward and they never reply to me :)
• modeless 4y ago
  Are people really inconvenienced by email spam anymore? My email is posted publicly all over the internet, it's been used to make hundreds of accounts for various other companies, it's been in innumerable data breaches, and I haven't changed addresses since GMail launched in 2004. In a bad week I might get two spam messages in my inbox. Each one is dealt with in probably around three seconds. On average I get less, probably around one per month. I really enjoy that the spam filter catches borderline messages like promotional newsletters from companies I do business with that I didn't intend to sign up for. And I can count on one hand the number of times since 2004 that an email that actually mattered was sent to my spam folder by mistake. Every form of communication I use has spam and most are much worse than email. I get SMS spam, phone call spam, snail mail spam, WhatsApp spam, phone notification spam. In most cases the spam is harder to deal with and a larger percentage of the total. Phone call spam and snail mail spam in particular are way above 50% for me. Even after doing all the marketing opt-outs I can find.
  • powerhour 4y ago
    > And I can count on one hand the number of times since 2004 that an email that actually mattered was sent to my spam folder by mistake. How often do you check? I see a few false positives a week.
    • modeless 4y ago
      Not often, but when I do check I don't find any so I don't see a need to check more often. And I don't later discover that I missed anything either.
  • nullc 4y ago
    > Are people really inconvenienced by email spam anymore? Now we get inconvenienced by spam in the form of overactive spam filters that take critically important messages from people we've been communicating with for years and files them as spam.
• mindslight 4y ago
  I've done this as well for over two decades, but with no spam filter besides mailavenger/greylisting for a time. I've gotten spam to places that have had their databases leaked and widely reported. Off the top of my head, Zynga and Consumerist. I've also gotten spam from individual eBay vendors (etc), to my ebay@ and paypal@ address. But there's no way to particularly stop that, beyond knowing that ebay and paypal leak my email address. I get a lot of spam to an admin@ address on a domain I bought that was evidently in use previously. I also get spam from companies I used quite a while ago, and were either acquired and renamed, or are still in business. I haven't purchased or even signed into the website of "PCB Fab Express" in over 15 years, but they still see fit to email me. In general I don't find it that much of a hassle to hit 'd' on spam, hence not particularly caring about a spam filter, or not setting up a procmail recipe that bounces the spammy businesses. FWIW I actually don't get much spam any more to the first category of email leaks. I'm sure it goes in waves with whatever lists are in vogue. I still do find the custom email addresses nice for creating a small impediment to cross-referencing surveillance data, and don't see any reason to stop them. If the saying "YourCompany@" to a Your Company rep was really that awkward, I'd switch to opaque shorter handles, but it hasn't been a problem. Sometimes I'll just own it and say I do this so I know when companies sell my email address to spammers. Also, I read my email with mutt in a terminal, possibly passing it through lynx when I need to. If my client loaded image bugs or other html nonsense, my experience might be much different.
• throwaway787544 4y ago
  I don't care if someone sells my data, I care if some company gets compromised and doesn't tell me. And it makes it harder for bots to crack the same account at multiple places.
• snowwrestler 4y ago
  Very few legitimate companies will sell lists of raw email addresses, to anyone. There's very little money in it (email lists are cheap) and the potential upside of keeping the email addresses is way bigger, particularly when your email address is married up with behavioral data like what you bought, what pages you visited, what bank you use, etc. Retailers make money from your email address by trying to use it to get you to spend more money with them. That can be as simple as sending you marketing emails--which many people consider spam! So when you hear people complain about "spam" from retailers, it's often this: real marketing emails that they are mad about getting. Companies can also use customer email addresses as tokens for targeting in ad networks. In doing so, they may upload your email address to the ad platform. In that case they are sharing it with another company, but it won't result in spam. It will result in greater correlation between the otherwise separate tracking of your behavior across companies. In this case, using company-specific email addresses may actually be an advantage in terms of foiling such correlation.
  • Macha 4y ago
    > Retailers make money from your email address by trying to use it to get you to spend more money with them. That can be as simple as sending you marketing emails--which many people consider spam! So when you hear people complain about "spam" from retailers, it's often this: real marketing emails that they are mad about getting. This is written like it's "not spam", but I'd consider that unsolicited marketing emails because I bought something once to be clearly spam - the only way these emails would not be spam to me would be if there was some sort of affirmative, opt in that was clear about what you're opting in for.
  • cm2012 4y ago
    One big exception to this is political campaigns and non profits who will sell all the info they possible can on you for 2 cents to as many people as they can.
• brianbreslin 4y ago
  So has anyone discovered a simple way to track all your canary emails in a tool like haveIbeenPwned ? That's been the only reason I don't 100% of the time generate an email per site. I've also found burnermail to be a super useful tool, they have a chrome extension which lets you generate a site/day specific alias and have it forward to your inbox, you can block them in their site too.
  • pavon 4y ago
    If you own your own domain, haveibeenpwned can show all compromised addresses for the entire domain. I don't know if it supports wildcard/pattern emails for things like gmail's plus addressing feature.
• kevinmgranger 4y ago
  I get spam to a certain company email. I can only assume it was due to a breach.
• kccqzy 4y ago
  That's absolutely not my experience. I still receive spam sent to adobe@<my custom domain>, following their data breach in 2013. It's not exactly Adobe selling my email to a spammer, but a data breach, and then marketers decided that would be a good target to blast their marketing emails.
• baobabKoodaa 4y ago
  I've also used company@mydomain type emails for about 6 years and my experience is different. I've had to close down several addresses due to spam. The worst offenders have been PartyPoker and Skrill, which appear to frequently sell my email address to unrelated gambling spammers.
• chrisan 4y ago
  > or are spam filters that good? Do know if you are getting _any_ spam or just that all of your spam is marked as such not reaching your inbox?
• jedberg 4y ago
  > Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good? I've been using custom email for a couple of decades. Definitely get spam on a bunch of them, including recently. The worst though is the email I registered with the county clerk for voting. That one gets a ton of spam.
• TheBozzCL 4y ago
  I use the same strategy. Same as you, the only email address I get spammed on is `contact@domain.com` because I link to it directly in my personal site. I would prefer to use randomly generated UUIDs instead, but keeping track of which service is what would be a huge headache. That being said, this alone seems to work great! I've always been curious about how many tracking companies have sophisticated-enough logic that they can tell two email addresses from the same domain belong to the same person. Probably not many, since it's such a niche solution. Now I need to get better at using random names instead of my own, when possible.
• pengaru 4y ago
  I've done the same for decades, and I definitely receive spam from some of them. The most spammy of them has been equifax, but that one was so publicly hacked that I didn't need spam to know about it. Confirmation has its value I guess. It'd be nice to know if equifax sold the information and got hacked, that's entirely ambiguous and now equifax has plausible deniability thanks to the hack. Le sigh.
• andersonmvd 4y ago
  Usually event organizers keep selling your e-mail address after you gave it to them. Some events are explicit about it, others not really. It's not like they really ask you, it's more or less a condition to join the event in most cases.
• borishn 4y ago
  I am doing the same exact thing with my domain and getting spam to accounts such as ParkNYC (NYC parking payment app) and other companies that should be safe.
• deleted 4y ago
  [deleted]
• threeboy 4y ago
  I do the same thing. A few of them (Adobe, linkedin) have gotten hacked and spammed to the gills (so I black hole them) them but it’s often rare and I’m realizing it’s not worth the effort to micromanage email aliases in this way.
• fencepost 4y ago
  I did that for years, and probably need to do some digging into the "catchall" mailbox they all dump into. I've had a few start receiving spam, which is how I knew when those companies had had some sort of data breach (looking at you, United Airlines, happened at least twice!) even if it was only via a third party marketing firm or the like.
• guiambros 4y ago
  I've been doing the same for 20+ years (started in 2001, at the time hosting my own sendmail), so I have used custom email aliases in thousands of sites, from retailers, banks, government websites, and everything else you can possibly imagine. My recent experience has been similar to yours, but it is a more recent development. In the beginning I used to receive a lot of spam -- sometimes dozens per day. I'd frequently get blasted with dozens of the same spam, to every possible alias they had access to. Sometimes they would use randomized From: addresses or other small customizations to trick spam filters, but frequently not even that. Also I remember receiving spam on addresses used for companies which had never publicly disclosed they'd been hacked (looking at you, NYC MTA [1]). A few times I tried reaching out to the company to alert them, but it was always met with skepticism, plain denial, or outright passive-aggressiveness (e.g., "_How do you know?_", potentially implying I was involved). Fool's errand. At some point I moved to Gmail when they started offering Google Apps for Business with custom domains. At the beginning their spam filter was very weak, but it got progressively better. Over the last 5-6 years, the volume decreased dramatically. At most I get a couple of dozen emails per week (almost all flagged as Spam). I'd imagine the combination of IP filtering, email authentication (DMARC, SPF, DKIM), and ML-based spam filtering got so good that spam isn't profitable for anymore. I also monitor my domains with Have I Been Pwned [2]. As of today, I have 59 of my aliases in leaked databases -- which is a small fraction of the leaks I've experienced firsthand over the years. [1] https://twitter.com/GuiAmbros/status/1555358970516328449 https://twitter.com/GuiAmbros/status/1555358970516328449 [2] https://haveibeenpwned https://haveibeenpwned
• anonymousiam 4y ago
  Well, after doing this for 30+ years, but not actually trying to run any experiments, I have found the opposite. Of the 1670 email aliases that I've created, I've received spam at about 5% of them. Sometimes it happens years after any interaction, possibly from a sale of assets after a shutdown. Sometimes it happens immediately (within a day or two of being created). Sometimes it's from a breach that the other party may not be aware of (yet). Sometimes it's from a dictionary email attack. Just last week I was spammed from South America to an email address I only ever provided to my local police station. I have no idea what "hot" email addresses sell for on the dark nets, but it's probably something greater than $0, which means the outsourced third-world CRM workers will scrape and sell them whenever possible.
• repler 4y ago
  Is this not what “+” addresses are for? Many email providers automatically create a folder with the “plus” name. For example: youremail+company@yourdomain.com Creates a folder named “company” and puts those received emails into it.
• nevster 4y ago
  Another data point - I do the same thing. Out of the 100's I've done it for, about maybe 3 seem to have been compromised.
• xdrosenheim 4y ago
  I do the same thing with my email and have actually gotten a few spam mails as a result. I have of course contact said companies and told them about it. None of them seems to be blatant selling of data, though. However, I am receiving a _bunch_ of spam email to "first.lastname@mydomain.xz". I do have one default inbox everything goes into, if it does not match a filter.
• 0xjmp 4y ago
  Buying a house. Lender immediately sold my email and phone number and I’ve been getting about a dozen aggressive sales messages a day. But hey, maybe it’s just a few bad apples.
  • hbosch 4y ago
    Phone, physical mail, e-mail too. Buying a house probably netted me more spam than anything I've ever signed up for online.
    • matthew1471 4y ago
      They call this “Life event marketing” - one of the companies posting physical mail to me declared the name of the company that they got my details from so I could then contact them and ask them to take me off the list.
• Uptrenda 4y ago
  You got lucky. Somehow you managed to avoid any one of those retailers being hacked and ending up in an email dump. Somehow you also avoided any website that does marketing or promotional emails (idk how?) Many companies put it in their ToS that they will send promotional emails by using their service. I'd wager next to no one wants a marketing email but businesses still delude themselves into thinking their customers won't hate them for it.
• hacym 4y ago
  Side note: if you’re an engineer that implements your sign up to force email from a “real domain”, screw you. I’ve run into multiple sites that force you to have a Gmail, Yahoo, or whatever else account and it’s obnoxious. It does nothing. Stop.
• cjoh 4y ago
  I'd be willing to bet you've not given your email to any political candidate or campaign.
• kazinator 4y ago
  > Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good? My experience with generated one-per-contact addresses is similar. I think pretty much 100% spam came from the ones I use for Usenet. In my case, mail destined for these addresses bypasses all anti-spam checks, so I know it's not the spam filters: there are none. (Filtering mail destined for generated addresses is counterproductive; you often need them in situations where maximum deliverly reliability is paramount. Plus, such a system is a complete anti-spam scheme; it doesn't need to be combined with any other.
• yellow_lead 4y ago
  Hi there, On August 8th, 2022, DigitalOcean discovered that our Mailchimp account had been compromised as part of a wider Mailchimp Security Incident. As a result, a number of DigitalOcean customer email addresses may have been viewed by an unauthorized individual. Impact to you No customer information other than email address was impacted
• kypro 4y ago
  I had to abandon an email address for similar reasons. I added a mailto link on my website and within weeks started to notice some spam. I then removed the mailto link and replaced in the format of, "me [at] domain [dot] com" but it didn't help much. Eventually I created a new email address and just used that all high priority stuff that I needed to read. All was good for a while but then a couple of companies that have my email address got hacked and I guess my info must have been sold because since then I've started receiving spam emails again. It's manageable at the moment, but I wonder if there will again come a time that I have to start over with a new email address.
• layer8 4y ago
  I’ve done the same, and there have been a dozen or so online shops, usually smaller-sized ones, for whose associated custom addresses I’m receiving spam. I don’t think they are selling their data, rather, they are getting hacked by third parties. There’s also cases like Dropbox who had a data breach a few years back, and for whose associated addresses I’m receiving some spam since.
• pinebox 4y ago
  Since 2005 I have been using unique randomly generated email addresses for every retailer, rebate, forum, SaaS, etc. Out of these ~550 unguessable addresses I have deactivated ~15 due to security incidents on the other end. Notables from this short list: - digikey.com (Feb. 2021) - gamasutra.com (Jun. 2017) - buydig.com - kickstarter.com (May 2017) - seagate.com (2016) Of course this doesn't include the addresses I have had to disable because companies either started sending me "legitimate" promotional emails I did not request or they did not respect my unsubscribe requests (I believe this is what we used to call "ham").
• mancerayder 4y ago
  Do you have an automation system to create the aliases that you can use ad-hoc without being in front of a terminal? Or do you just use + in the email address?
  • ttyprintk 4y ago
    If you rely on a web-based generator, be sure to find an in-browser implementation. If I had one on the server-side, I wonder what passively collected secrets would float by.
• inopinatus 4y ago
  I’ve been doing the same for thirty years. I do get spam to these addresses. The most frequent recipients are the ones I rotate annually for LinkedIn. Mostly UCE rather than scams. Anecdotally it looks like 2019-2020 was a lousy period for their information security.
• jryb 4y ago
  I've been doing the same thing and also have gotten no spam to the non-main address. That said, I don't get much spam at all. I recently decided to stop the practice.
• sneak 4y ago
  I get physical mail spam to unique names in billing addresses I have used for retailers. It's definitely a problem for postal mail addresses.
• eranation 4y ago
  I have a feeling LinkedIn is the new spam abuser. I have no direct proof (it could be me signing up to a shady conference / email list) but the moment I got a new company email address and a co-founder title, the floodgates got opened, I get 4-5 "handcrafted" (automated to look like ones) emails plus the "following up to make sure you got my email" or "bringing it up your mailbox", most have no unsubscribe links and have a "let us know if you don't want to hear from us again". From legal services, graphic design, off shore hiring / staff augmentation, financial services. I get it that people need to sell to stay in business, so does my company, but it's starting to be a nuisance, especially since it many times passes the spam filters, and each email gets 2-3 "just following up" emails.
• defaultcompany 4y ago
  This is a very bad idea which I have also done and am currently in the long process of undoing. I have >800 email addresses on my own domain. What happens if I do not renew the domain name - either by accidentally missing the renewal date or in the extreme example, if I die? At that point anyone can register the domain and can receive (and send) email for all my accounts, very likely leading to the accounts being compromised. Even if I'm dead I still don't want my mortgage or bank accounts being hacked, I want them in the hands of my heirs. So yeah... very bad idea or at the very least, not worth the minor reduction in spam for the risk.
• novok 4y ago
  I have gotten random spam email to one so far from https://parkmobile.io/ https://parkmobile.io/ and it came from them getting breached.
• Semaphor 4y ago
  You know what received spam till I blocked it? ledgerwallet@domain.tld I don’t think any half-way decent sites are selling your mails to spammer, but hacks and breaches happen, as they did to ledger [0]. Besides that, there’s a chinese store and a vaping store that both have no easy unsubscribe, so those addresses are also blocked. [0]: https://haveibeenpwned.com/PwnedWebsites#Ledger https://haveibeenpwned.com/PwnedWebsites#Ledger
• yc-kraln 4y ago
  checks spam folder godaddy@kraln.com allwinner10@kraln.com couponmom@kraln.com ppcgeeks@kraln.com Each one either directly or indirectly related to a known breach (i.e. haveibeenpwned). It's not just selling your email that could happen, but also careless IT security resulting in your email getting in the hands of spammers.
• shric 4y ago
  I've done this since 1998 and generally agree with you, although I've had a handful that get spammed. Maybe I sign up to more dubious sites.
• joshka 4y ago
  I have 31 addresses (of hundreds-thousands) over a similar 10 year period 2012-2022. My guess is that most of these are things where there's been a database leak (often these appear in the hibp database). > Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good? If your spam filter is catching something, then you're receiving spam, it's just not being delivered. For the most part, I get more ham (false positives) than negatives (actual spam).
• weitzj 4y ago
  One counter example is MyFitnessPal. I am doing the same thing as you do, and I am getting spammed on this address.
• jfoster 4y ago
  It seems it can happen in Australia. Only a sample size of 1, but I took a trip to Melbourne earlier in the year. Prior to that, I hadn't received any Melbourne-centric spam. At some point during the trip, I started receiving spam from various Melbourne businesses.
• OJFord 4y ago
  It's not just spam, but it being passed around between businesses without your consent (or maybe if you read some massive terms with a lawyer hat on you did). E.g. I bought insurance after looking at a comparison site, used different email addresses for each, and then found out the comparison site must've passed on 'my email address' to the insurance company when I got a later email, that turned out to be from a third company contracted to do part of their business; to whom they'd given the wrong email from my file, the one I didn't know they had. It's not a huge problem, but it makes you aware of these things.
• t0k0l0sh 4y ago
  I've done the same for about 20 years, usually using <company>@<mydomain> or <theirdomain>@<mydomain> When I start receiving spam at one of these aliases, I'll update my email address with the relevant site(s), then after a cooldown period to ensure no more legitimate mail arrives at the original alias, I'll use the original alias as a spam trap - any mail sent to it is learned as spam, then accepted and discarded by my MTA.
• jatin085 4y ago
  I had a Yahoo account created in year 2002, the time when most of the sites including Yahoo Mail (I suppose) did not support HTTPS. Not sure if that was the reason but with every email exchanged, I found the number of spam messages kept increasing. Later in around 2015, I started using Yahoo's 'Disposable Email Addresses' features but the spam load on my original email address was too high that I had to create a new user account in a year or two later. I still use Yahoo Mail primarily because of its 'Disposable Email Addresses' super-feature. For my new Yahoo account, I have maintained the habit of creating new disposable email addresses for every site I need to register with. The disposable addresses always contain the name of site/organization I am registering with. I have also kept a few pre-created email addresses at my disposal :) in case I need to provide one on a retail store. In last five years, there hasn't been a single spam message on any of these disposable addresses. I always had the option to delete these addresses as soon as I start receiving spams on them but until date, I never needed to exercise them. The messages that are moved to Spam folder are always false positives, so in a way, I don't lose sight of any message just because the mailing service decided to mark it as spam.
  • matthew1471 4y ago
    I have a similarish story - I went to New York once (I didn’t book it). I connected to the hotel WiFi and any other free WiFi in the area. I wasn’t using TLS. I received a lot of New York related spam for a while.. it dropped off after a while - I guess these lists have a shelf-life.
• yubiox 4y ago
  This is bad timing since this has dropped off the first page of HN but just today I got a scam email to my home loan address cenlar@whatever. So the fools either sold my address or were hacked.
• whoomp12342 4y ago
  oh, but have you tried applying for a job with custom emails? pretty sure recuriters (inhouse and external) dgaf and will readily sell it
• aine 4y ago
  I do the same thing for the last several years and the only email that was spammed is the mailbox used for Digital Ocean. Seems like they had some leak (or may be sold that data, not sure), but I received spam emails with some sketchy links only on that email.
• stereoradonc 4y ago
  Fastmail user here. I can testify to this strategy. I consistently keep my inbox zero and almost zero spam. Either way, the Fastmail spam filter is excellent. This is from a non-technical user who doesn't use sieve rules (which are even better and more granular)!
• nickm12 4y ago
  This has been exactly my experience. I have use custom email addresses online for at least 13 year and I have (almost) never gotten spam to these addresses. I have no spam filter on my account, so if I received spam email I would know. There have been a few random incidents. I did get one spam message to my kickstarter email address, presumably because some project I funded did not protect my address. I also once got spam from a reservation I made for brunch at a local jazz club.
• paulnpace 4y ago
  Krebs recently had an article on email aliases[1], and one thing I found interesting is the report that spam list managers actively remove obvious aliases completely because those addresses are low quality (they want to sell their lists, so they promote that their lists are higher quality) plus the aliases can result in being the first tip that a database has been leaked. I've had obvious aliases at a number of compromised databases and so far none of those generate any spam. In fact, recently I received an email from some white hat that my address was part of a site that has been hacked twice and the site-owners have not reported it, so the white hat was sending out email blasts to tell people. I've never been spammed to that address. Where I've seen one alias spread when it somehow ended up on some political list. A non-political blogger's newsletter address has spread from here to kingdom come and I suspect that the blogger had someone else managing the sending of that newsletter who decided to borrow the list, and the people he gave it to decided to do some more sharing. [1] https://krebsonsecurity.com/2022/08/the-security-pros-and-cons-of-using-email-aliases/ https://krebsonsecurity.com/2022/08/the-security-pros-and-co...