12 ms·
Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good? Email databases for sale are not always for spam or malwar
by LinuxBender 4y ago
Is the fear of "people selling your email to spammers" a modern myth, or are spam filters that good?
Email databases for sale are not always for spam or malware. They are often used for tracking and cross marketing calculations. Placing a companies name in the address will signal a canary and they may likely filter your contact out of their database or at least flag it and treat it differently.
I've been using email canaries for decades but recently had to adjust my canaries to be less obvious. A few vendors got upset that I had their name in the address and one even accused me of fraud and canceled my $500 gift card. That was the Tractor Supply Company.
Either way I will continue using canaries and multiple domains as it is a good way to be filtered out of some cross marketing databases and to avoid some behavioral tracking and some machine learning. It is also useful to find companies that get upset. This is an indicator to me they lack integrity and should be avoided. Canaries are also a good indicator to detect if a company has been compromised.
- nibbleshifter 4y ago> A few vendors got upset that I had their name in the address I have had this happen a few times. > Canaries are also a good indicator to detect if a company has been compromised. Yep, this is a fantastic use case.
- adamfeldman 4y agoThis is exactly my use-case and experience after many years of custom catch-all'ing. I've noticed a couple breaches, and also a few unexpected transfers of my email address between semi-related parties. Just once it appeared an address was sold via a marketing list, after filling out a lead-form for a free online conference hosted by multiple companies that you've seen on HN. Surprisingly, unsubscribing tends to stop emails from everyone.
- f4c39012 4y agoSlightly easier* than running a domain, i've had luck with myemail+CompanyX@gmail.com when signing up to CompanyX. Gmail handles the '+' transparently (in the same way as it ignores '.') and delivers the email to myemail@gmail.com. It is fun to receive a survey about "an anonymous company you have used in the past"... sent to myemail+uber@gmail.com. *yet less reliable, '+' in email addresses isn't always accepted, and when it is sometimes only partly, e.g. signup works but password reset doesn't
- nibbleshifter 4y agoTbh with GSuite + a 5$ domain I get catch alls for minimal effort. I used to use + addressing schemes, but abandoned it for the reasons you mentioned (websites breaking horribly).
- adamfeldman 4y agoExactly. Catch-all setup on Google Workspace/G Suite/too-many-renames is usually obtuse but it’s a one-time tutorial effort.
- nibbleshifter 4y agoI wonder if there's a way to script setting it up to be honest, I end up about an hour deep in help docs each time I set up a new domain+email trying to work out how to make a catch all and how to configure the thing so replies come from the right email.
- adamfeldman 4y agoOh, I’ve never realized replies could be made to come from the right email. I manually add addresses as-needed (once a month or so). I think there’s an unofficial Terraform provider but I haven’t looked recently.
- ryantgtg 4y agoWouldn’t it trivial for them to strip out all values from + to @ prior to selling your address?
- deleted 4y ago[deleted]
- nibbleshifter 4y agoYes. I've written code that does this for parsing leaked email lists before as part of a normalizing step.
- encryptluks2 4y agoI used this to determine that Xfinity was compromise, yet still no acknowledgement despite reporting the issue to them and they went through some spiel about how I received the email by mistake and continue to receive emails by mistake at <randomword>_<randomword>@<customdomain>. The only person I shared that email with was them, and never had the issue with another provider.
- seanp2k2 4y agoIf I have to provide an address to get a download link, that address will be either postmaster@aol.com or abuse@domain-of-the-company . EMailing the link to the provided address will probably just make me seek out different software. Make software that users want to sign up to hear more about; don't force them to opt in to marketing just to try something. It's the first impression and sets the tone with your company.
- leaflets2 4y ago> fantastic use case How does it work? If a company to which you have provided an email address, gets compromised, it's likely that you'll start getting automated pishing emails to that address? And that the address ends up in... some "warning" database like Have I Been Pawned, and you'll get notified? Or something else? Seems like a good idea :-)
- csdvrx 4y ago> A few vendors got upset that I had their name in the address When it happens, I say "this is because your company is so important to me that it has its own mailbox to be prioritized accordingly" It worked every single time :)
- dspillett 4y agoSame, though go with “I use the incoming address name to file things into the right folder, so work things, banking things, shopping, and such, are separated” – I don't butter them up by making them sound important enough that I created a mail inbox just for them. If they still object then I don't sign up. I've had web form refuse to accept an email address with their company name in, so that sale went elsewhere, and one physical retail store wouldn't let me sign up to their prize draw with such an address, so I didn't. In neither case do I suspect anything of value was lost by myself!
- PebblesRox 4y agoI guess ROT13 could also be a last resort if signing up is important enough.
- nbk_2000 4y agoSlightly mangling the name (e.g. target => trget) is another way.
- sbf501 4y ago> Placing a companies name in the address will signal a canary and they may likely filter Oh, good point. I guess I may have invalidated all my research! :|
- TheJoeMan 4y agoBut you’ve stumbled on an even better solution! Now you are spam free + tracking free.
- aspyct 4y agoOn the other hand, your address is being filtered out, so... win? :D
- registeredcorn 4y agoIf you're interested in getting "true" results, perhaps you could do something like this: name1@website.com name2@website.com etc. In a spreadsheet, you have one column with the number, and another with the company name. You might want to change this up, putting the identifier in different parts of the email address, to avoid similar "canary" signals. Personally, I use BitWarden to generate usernames for each website, to help keep my fingerprint (somewhat) scrambled. LastPass also has a good username generator. [1] I would just avoid using complete non-sense words, since there might be some amount of human review. [1] https://www.lastpass.com/features/username-generator https://www.lastpass.com/features/username-generator
- bencollier49 4y agoJust writing their name in reverse would probably work, and be less time consuming.
- slowmovintarget 4y agoOnly if you actually want to receive their spam for research purposes.
- seanp2k2 4y ago
- david_draco 4y agoSomeone should sign up for all the mailing lists with a email address used nowhere else and track the cross-mailings. Maybe a bubble babble hash of the company name as the email prefix, and a big mailer like gmail or protonmail as the server. When the email is leaked and the company does not inform the user, report the company via GDPR.
- jader201 4y ago> Someone should sign up for all the mailing lists with a email address used nowhere else and track the cross-mailings. I may be misreading your comment, but if not, it sounds like the OP (of this Tell HN) did exactly that.
- deleted 4y ago[deleted]
- rotten 4y agoFastmail offers a masked email feature for one-time email addresses: https://www.fastmail.help/hc/en-us/articles/4406536368911-Masked-Email https://www.fastmail.help/hc/en-us/articles/4406536368911-Ma...
- atmosx 4y agoThe 1Password integration doesn’t work for me. Not sure why :-(
- withinboredom 4y agoWorks fine for me. Maybe you have some conflicting settings enabled?
- atmosx 4y agoI wonder what settings would that be.
- seanp2k2 4y agoI've seen sites that disallow auto-generated addresses, super lame and makes me not want to use them, not sure how common that is today.
- reaperducer 4y agoI've seen sites that disallow auto-generated addresses, super lame and makes me not want to use them, not sure how common that is today. Expect this to change, if Apple's anonymous e-mail forwarding becomes popular. Just like when IT departments (including the one at my company) insisted that everyone use Blackberries because iPhones weren't suitable for a corporate environment. Once enough C-levels start using any feature, it spreads like wildfire.
- antifa 4y ago> Expect this to change, if Apple's anonymous e-mail forwarding becomes popular. They'll continue to block the non-apple ones regardless.
- raverbashing 4y ago> A few vendors got upset that I had their name in the address Kinda annoying of then, maybe I would go for an opaque (or maybe just a simplified) canary. Like the initials or abbreviation
- YetAnotherNick 4y ago> A few vendors got upset that I had their name in the address rot13 FTW
- seanp2k2 4y agotoo much work to remember each time for logins if it's something frequently used. The iCloud way of generating emails is great but only works well on my iDevices. I used to use endjunk.com for everything, and it was the same kind of "anything@you.endjunk.com" setup, but one day they just disappeared with no warning and I lost a few accounts because of that. Learned my lesson and just switched to GMail.
- artificialLimbs 4y ago>> too much work to remember You don't use a password manager?
- KMnO4 4y agoI’m not sure what encoding this is, but sometimes I do QWERTY shifts. Google becomes hpphar. Easy to [en/de]code on the fly by looking at your keyboard.
- smsm42 4y agoThat's a simple monoalphabetic substitution cypher, as would be any one-to-one fixed mapping.
- makeitdouble 4y agoYou probably want to stay upset and explain why they are. I feel working around the issue is counter to the point.
- koliber 4y agoI was offered a few employee discounts by front line associate because of using an email address with a company name. I declined but found it awkward to explain the details.
- Handytinge 4y agoI also follow this system and have had this. It's disconcerting when companies who manage your PII don't understand the format of an email address.
- joshka 4y agoI added @lists. to the email address and found that it lessened the need to explain.
- buu700 4y agoI had a funny interaction with a financial institution about this at one point. They were having a lot of trouble understanding that company@mydomain.com was the correct email address. Eventually the conversation went like: "So you're saying you created a new email address just to use with us?" "Sure, yeah." "...That's weird."
- masklinn 4y agoThe weirdest of these i had were support agents who thought I was a colleague because I usually use <theirdomain>@<mydomain>
- ejb999 4y agoI did that for one of my amazon accounts a few years back when i registered at an amazon conference (probably aws reinvent)- i.e. amazon@mydomain.com - and for about 6 months I got onto some internal email list at amazon/aws, definitely not intended for the public, likely because someone queried for all email address that had 'amazon' in the address from this registration list - thought it was pretty funny, but eventually they stopped - someone probably figured out what they did wrong. Also have one for thifty@mydomain.com (the car rental company) - when they saw my email address at the counter they gave me the employee discount rate - I didn't correct them :)
- OJFord 4y agoI got cc'd into internal discussions at the management company for my flat block, about the block.
- mkl 4y ago> A few vendors got upset that I had their name in the address I've had more confused than upset, but Samsung straight-up refuses to accept email addresses with "samsung" in them. I'm not sure what they think they're accomplishing. I think I get more spam from hacked/leaked email databases than sold ones. Dropbox is the worst (signed up and used it briefly over a decade ago, and now suffer an eternity of spam).
- donarb 4y agoYou should've just changed the address to 'spamsung'.
- simondotau 4y ago> A few vendors got upset that I had their name in the address A few years ago I created an account with a freemium publisher with the email address their.domain@my.domain and as soon as I logged into my account I had full unlimited access to all content. I suspect their system had a routine that detected staff accounts based on a string search for their domain.
- reledi 4y agoI've seen this bug in prod while consulting. Bad regex.
- simondotau 4y agoJust adding an @ to the string match would make it a bit more robust. (Would still be vulnerable to jim@their.domain.my.domain, so add a $ on the end if it’s a regexp.) But even with the most rudimentary web-dev languages you can replace the inner string match with a lowercase transform, split on @ and perform an exact string compare. Insanely simple stuff. Probably still a one-liner in any sane/productive framework.
- xdrosenheim 4y agoI have been thinking about using some sort of UUID-generator ([UUID]@mydomain.xz) whenever I sign up for a new site, but I just can not think of a _good_ way to keep track of them.
- tomcam 4y agoDatabase? Text file?
- flog 4y ago1Password?
- beprogrammed 4y agoGenerated algorithmically from their domain. I believe sqrl uses a system like that.
- sneak 4y agoIf only there were some convenient software for keeping track of your unique login names and passwords for each site you use.
- xdrosenheim 4y agoIf you mean password manager, sure. But I was thinking of e-mails received, how would I know if the emails came from the "right" sites? Would have to open up a text file, or login to my password manager, just to check. I do not think that is a great way to keep track of it.
- joshka 4y agoSeen masked email integration in 1password https://1password.com/fastmail/ https://1password.com/fastmail/ Or iCloud https://support.apple.com/en-us/HT210425 https://support.apple.com/en-us/HT210425
- Semaphor 4y ago> few vendors got upset that I had their name in the address No one got upset, but a record label was confused and asked me about it, and another company had their legal department ask me under what license I use their TM ;) In both cases a simple explanation was the end of it.
- aaaaaaaaata 4y ago> another company had their legal department ask me under what license I use their TM Please name!, or give details of size. Not for shame — for curiosity!
- Semaphor 4y agoTÜV Nord [0], 12k employees, 1.37 million € revenue As I said, one quick explanation of single-use emails cleared everything up. [0]: https://en.wikipedia.org/wiki/T%C3%9CV_Nord https://en.wikipedia.org/wiki/T%C3%9CV_Nord
- cosmodisk 4y agoWe used to have one of the top range email marketing software at work. Emails, such as info@, contact@ and some others are automatically excluded and you can't even send any marketing to those.
- brainbag 4y agoI've had this happen a few times, but I was able to resolve them all except one cadre. Stitch Fix shut down my account abruptly, informing me of "security concerns" and disabled my account without any recourse after I'd spent a bunch of time setting it up. No offering of personal verification mattered. It was disappointing.
- hammyhavoc 4y agoI've heard that fraud sentiment several times from friends of mine who do exactly that with the company name in the email address. They've since moved on to a randomly generated string of alphanumeric characters, this is put into a spreadsheet, and they write down when and where they used it. I'd like to start doing this, but wondering what I would do if I figured out someone had passed the address on or been compromised.