11 ms·

> A few vendors got upset that I had their name in the address I have had this happen a few times. > Canaries are also a good indicator to detect if a company

> A few vendors got upset that I had their name in the address I have had this happen a few times. > Canaries are also a good indicator to detect if a company has been compromised. Yep, this is a fantastic use case.

adamfeldman 4y ago
This is exactly my use-case and experience after many years of custom catch-all'ing. I've noticed a couple breaches, and also a few unexpected transfers of my email address between semi-related parties. Just once it appeared an address was sold via a marketing list, after filling out a lead-form for a free online conference hosted by multiple companies that you've seen on HN. Surprisingly, unsubscribing tends to stop emails from everyone.
- f4c39012 4y ago
  Slightly easier* than running a domain, i've had luck with myemail+CompanyX@gmail.com when signing up to CompanyX. Gmail handles the '+' transparently (in the same way as it ignores '.') and delivers the email to myemail@gmail.com. It is fun to receive a survey about "an anonymous company you have used in the past"... sent to myemail+uber@gmail.com. *yet less reliable, '+' in email addresses isn't always accepted, and when it is sometimes only partly, e.g. signup works but password reset doesn't
  - nibbleshifter 4y ago
    Tbh with GSuite + a 5$ domain I get catch alls for minimal effort. I used to use + addressing schemes, but abandoned it for the reasons you mentioned (websites breaking horribly).
    - adamfeldman 4y ago
      Exactly. Catch-all setup on Google Workspace/G Suite/too-many-renames is usually obtuse but it’s a one-time tutorial effort.
      - nibbleshifter 4y ago
        I wonder if there's a way to script setting it up to be honest, I end up about an hour deep in help docs each time I set up a new domain+email trying to work out how to make a catch all and how to configure the thing so replies come from the right email.
        adamfeldman 4y ago
        Oh, I’ve never realized replies could be made to come from the right email. I manually add addresses as-needed (once a month or so). I think there’s an unofficial Terraform provider but I haven’t looked recently.
  - ryantgtg 4y ago
    Wouldn’t it trivial for them to strip out all values from + to @ prior to selling your address?
    - deleted 4y ago
      [deleted]
    - nibbleshifter 4y ago
      Yes. I've written code that does this for parsing leaked email lists before as part of a normalizing step.
      - archi42 4y ago
        Not sure why this is downvoted. I can imagine non-nefarious reasons to collect these lists.
        EGreg 4y ago
        Why do people downvote stuff that simply triggers them? This is useful info
        hammyhavoc 4y ago
        Because it's cruise control for not needing to justify their point of view whilst still pushing their perspective. Sick, right? Votes and e-peen points have to be the worst aspect of HN and Reddit.
        DocTomoe 4y ago
        It's spam detection evasion. Also, depending on the legislative framework, it might be illegal: If I give company my email address with a plus and an identifier in it, I give them permission to contact me under that specific email (with the plus on it). If I as a result receive emails under another address (without the plus on it), this might be a GDPR violation.
        4y ago
  - jdmichal 4y ago
    Sometimes it's only partly supported, in the sense that the website will just break if your email has a `+`. I'm pretty sure I encountered that one with both Disney and Royal Caribbean reservation workflows just flat out breaking.
    - remus 4y ago
      > I'm pretty sure I encountered that one with both Disney and Royal Caribbean reservation workflows just flat out breaking. My favourite is services that let you sign up with a + in the address but then break when you try and login or reset your password.
    - zimpenfish 4y ago
      I switched to '-' instead of '+' which was a trivial change in exim.conf and saved my sanity because there was just too many places which either break on '+' or refuse to accept it in the first place.
  - kevinmgranger 4y ago
    I used to do this, until I had to reply to an automated email for some customer support system. It rejected all my replies because the From: didn't match.
    - sneak 4y ago
      You can send emails with any From: header you wish.
      - dotancohen 4y ago
        Not from within Gmail's web interface. I personally use Thunderbird and AWS SES to send mail, but many people who grew up on web interfaces are intimidated by Thunderbird.
        denton-scratch 4y ago
        > many people who grew up on web interfaces are intimidated by Thunderbird. That surprises me; it's web interfaces that intimidate me.
        dotancohen 4y ago
        Yes, I also prefer Thunderbird. But almost nobody that I've introduced it to was interested in using it.
        OJFord 4y ago
        Yeah you can, you can default it to send from the address the email you're replying to was sent to too. It's the only thing I missed when I switched to Fastmail. (Which has since added it too, but not before I left in favour of my own SES-based solution.)
        dotancohen 4y ago
        I'd love to know how. Tips welcome, thank you.
  - overspeed 4y ago
    I can attest to the unstable handling of '+' suffixed emails. UPS allowed me to ship a package as guest with myemail+ups@gmail.com but wouldn't let me create an account with the same email ID. I had no way to track the package pickup onwards.
    - mook 4y ago
      Can confirm; once signed up as foo+bar@example.com, everything worked (including the confirmation mail)… and then the address was automatically normalized (‽) as foobar@example.com and I could no longer receive any mail (since that's a different account altogether).
    - Fnoord 4y ago
      There's also the unstable handling of . symbol (dot or dots) in email address before @ symbol. Gmail allows dots in email address before @ and normalizes them, so the same address with or without dots works. This leads to funny behavior such as unlimited account creation with the same email address (yes, + symbol would also work for this but that works almost everywhere and is better known) or my wife thinking she does not have an account while she does, creating a new one instead.
      - leaflets2 4y ago
        > unlimited account creation Nice, hadn't thought about :-)
  - tome 4y ago
    How did they expect you to respond to a survey about an anonymous company?
    - dllthomas 4y ago
      I assume it was a more general survey. Uber might want to know what people are doing for transportation even when it's not Ubering.
encryptluks2 4y ago
I used this to determine that Xfinity was compromise, yet still no acknowledgement despite reporting the issue to them and they went through some spiel about how I received the email by mistake and continue to receive emails by mistake at <randomword>_<randomword>@<customdomain>. The only person I shared that email with was them, and never had the issue with another provider.
seanp2k2 4y ago
If I have to provide an address to get a download link, that address will be either postmaster@aol.com or abuse@domain-of-the-company . EMailing the link to the provided address will probably just make me seek out different software. Make software that users want to sign up to hear more about; don't force them to opt in to marketing just to try something. It's the first impression and sets the tone with your company.
leaflets2 4y ago
> fantastic use case How does it work? If a company to which you have provided an email address, gets compromised, it's likely that you'll start getting automated pishing emails to that address? And that the address ends up in... some "warning" database like Have I Been Pawned, and you'll get notified? Or something else? Seems like a good idea :-)

adamfeldman 4y ago

This is exactly my use-case and experience after many years of custom catch-all'ing. I've noticed a couple breaches, and also a few unexpected transfers of my email address between semi-related parties. Just once it appeared an address was sold via a marketing list, after filling out a lead-form for a free online conference hosted by multiple companies that you've seen on HN. Surprisingly, unsubscribing tends to stop emails from everyone.

f4c39012 4y ago
Slightly easier* than running a domain, i've had luck with myemail+CompanyX@gmail.com when signing up to CompanyX. Gmail handles the '+' transparently (in the same way as it ignores '.') and delivers the email to myemail@gmail.com. It is fun to receive a survey about "an anonymous company you have used in the past"... sent to myemail+uber@gmail.com. *yet less reliable, '+' in email addresses isn't always accepted, and when it is sometimes only partly, e.g. signup works but password reset doesn't
- nibbleshifter 4y ago
  Tbh with GSuite + a 5$ domain I get catch alls for minimal effort. I used to use + addressing schemes, but abandoned it for the reasons you mentioned (websites breaking horribly).
  - adamfeldman 4y ago
    Exactly. Catch-all setup on Google Workspace/G Suite/too-many-renames is usually obtuse but it’s a one-time tutorial effort.
    - nibbleshifter 4y ago
      I wonder if there's a way to script setting it up to be honest, I end up about an hour deep in help docs each time I set up a new domain+email trying to work out how to make a catch all and how to configure the thing so replies come from the right email.
      - adamfeldman 4y ago
        Oh, I’ve never realized replies could be made to come from the right email. I manually add addresses as-needed (once a month or so). I think there’s an unofficial Terraform provider but I haven’t looked recently.
- ryantgtg 4y ago
  Wouldn’t it trivial for them to strip out all values from + to @ prior to selling your address?
  - deleted 4y ago
    [deleted]
  - nibbleshifter 4y ago
    Yes. I've written code that does this for parsing leaked email lists before as part of a normalizing step.
    - archi42 4y ago
      Not sure why this is downvoted. I can imagine non-nefarious reasons to collect these lists.
      - EGreg 4y ago
        Why do people downvote stuff that simply triggers them? This is useful info
        hammyhavoc 4y ago
        Because it's cruise control for not needing to justify their point of view whilst still pushing their perspective. Sick, right? Votes and e-peen points have to be the worst aspect of HN and Reddit.
      - DocTomoe 4y ago
        It's spam detection evasion. Also, depending on the legislative framework, it might be illegal: If I give company my email address with a plus and an identifier in it, I give them permission to contact me under that specific email (with the plus on it). If I as a result receive emails under another address (without the plus on it), this might be a GDPR violation.
        4y ago
- jdmichal 4y ago
  Sometimes it's only partly supported, in the sense that the website will just break if your email has a `+`. I'm pretty sure I encountered that one with both Disney and Royal Caribbean reservation workflows just flat out breaking.
  - remus 4y ago
    > I'm pretty sure I encountered that one with both Disney and Royal Caribbean reservation workflows just flat out breaking. My favourite is services that let you sign up with a + in the address but then break when you try and login or reset your password.
  - zimpenfish 4y ago
    I switched to '-' instead of '+' which was a trivial change in exim.conf and saved my sanity because there was just too many places which either break on '+' or refuse to accept it in the first place.
- kevinmgranger 4y ago
  I used to do this, until I had to reply to an automated email for some customer support system. It rejected all my replies because the From: didn't match.
  - sneak 4y ago
    You can send emails with any From: header you wish.
    - dotancohen 4y ago
      Not from within Gmail's web interface. I personally use Thunderbird and AWS SES to send mail, but many people who grew up on web interfaces are intimidated by Thunderbird.
      - denton-scratch 4y ago
        > many people who grew up on web interfaces are intimidated by Thunderbird. That surprises me; it's web interfaces that intimidate me.
        dotancohen 4y ago
        Yes, I also prefer Thunderbird. But almost nobody that I've introduced it to was interested in using it.
      - OJFord 4y ago
        Yeah you can, you can default it to send from the address the email you're replying to was sent to too. It's the only thing I missed when I switched to Fastmail. (Which has since added it too, but not before I left in favour of my own SES-based solution.)
        dotancohen 4y ago
        I'd love to know how. Tips welcome, thank you.
- overspeed 4y ago
  I can attest to the unstable handling of '+' suffixed emails. UPS allowed me to ship a package as guest with myemail+ups@gmail.com but wouldn't let me create an account with the same email ID. I had no way to track the package pickup onwards.
  - mook 4y ago
    Can confirm; once signed up as foo+bar@example.com, everything worked (including the confirmation mail)… and then the address was automatically normalized (‽) as foobar@example.com and I could no longer receive any mail (since that's a different account altogether).
  - Fnoord 4y ago
    There's also the unstable handling of . symbol (dot or dots) in email address before @ symbol. Gmail allows dots in email address before @ and normalizes them, so the same address with or without dots works. This leads to funny behavior such as unlimited account creation with the same email address (yes, + symbol would also work for this but that works almost everywhere and is better known) or my wife thinking she does not have an account while she does, creating a new one instead.
    - leaflets2 4y ago
      > unlimited account creation Nice, hadn't thought about :-)
- tome 4y ago
  How did they expect you to respond to a survey about an anonymous company?
  - dllthomas 4y ago
    I assume it was a more general survey. Uber might want to know what people are doing for transportation even when it's not Ubering.

encryptluks2 4y ago

I used this to determine that Xfinity was compromise, yet still no acknowledgement despite reporting the issue to them and they went through some spiel about how I received the email by mistake and continue to receive emails by mistake at <randomword>_<randomword>@<customdomain>. The only person I shared that email with was them, and never had the issue with another provider.

seanp2k2 4y ago

If I have to provide an address to get a download link, that address will be either postmaster@aol.com or abuse@domain-of-the-company . EMailing the link to the provided address will probably just make me seek out different software. Make software that users want to sign up to hear more about; don't force them to opt in to marketing just to try something. It's the first impression and sets the tone with your company.

leaflets2 4y ago

> fantastic use case How does it work? If a company to which you have provided an email address, gets compromised, it's likely that you'll start getting automated pishing emails to that address? And that the address ends up in... some "warning" database like Have I Been Pawned, and you'll get notified? Or something else? Seems like a good idea :-)