17 ms·

The IAB loves tracking users but hates users tracking them

391 points by edent 4y ago

asimpletune 4y ago
Email relays are the future. I use the one that comes with my Apple+ subscription, but I think there are others. Basically, per domain emails that fwd to your real email.
Hippocrates 4y ago
This is a great case for using iCloud “hide my email.” Curiously, I tried using it with “sign in with Apple” on slack and slack rejected it as a “hidden email.” I was able to circumvent that by using the regular sign in flow with a pre-generated “hide my email” address.
- dkdbejwi383 4y ago
  > and slack rejected it as a “hidden email.” Wow, that's pretty scummy behaviour! I wonder what the rationale is behind this?
  - crote 4y ago
    Spammers and scammers. People are constantly trying to use any service for illicit purposes. A somewhat-easy way to deal with that is to just ban them. Because an email address is used as username and an email address usually maps 1:1 to a person, this means you just got rid of a Bad Person. This breaks if access to new email addresses is trivial. You now have to invest actual effort into validating that a new account isn't someone trying to do bad stuff. Or you can just block all the services providing easy access to email addresses and outsource the issue to big providers like GMail and Apple. It's a lot less effort, and you'll lose near-zero legitimate customers...
    - mthoms 4y ago
      True, but Apple's hidden emails are tied to a real credit card (not free) and can't be generated in bulk (AFAIK). I'm not inclined to give any service the benefit of the doubt here until there is some evidence that Apple emails are indeed being used for this purpose. I haven't seen any such evidence (but I'm open to it).
  - eclipticplane 4y ago
    Slack gets used as Command and Control servers for malware and bot networks -- same as Discord. They are commonly installed so their network traffic isn't suspicious. They're also free. Blocking "hidden email" services is an easy first line of defense. You also can't register with mailinator.com email, for example.
    - mthoms 4y ago
      Apple's hidden emails aren't free. They are tied to a credit card and a phone number. It seems to me they are less likely to be abused than gmail.
- crossroadsguy 4y ago
  I think only those users use Apple’s HideMyEmail who have promised themselves to forever use Apple devices and forever having the paid plan, and never want to start a mail conversation from any of those emails. For others a domain, a mail provider works best with catch-all.
- thewebcount 4y ago
  How can they tell any iCloud address is a “hide my email” address? They generally use real words plus a number. Something like coffee_bike57@icloud.com. That seems like something a real human could also think up.
  - jackson1442 4y ago
    when you do it through Sign in with Apple (not the autofill field on your keyboard) it looks more like oalshjidfa9378rha@privaterelay.apple.com
- benhurmarcel 4y ago
  For those who don't use iCloud, DuckDuckGo also has the same service with @duck.com emails.
llimos 4y ago
> If you want to opt out of this - and you trust the IAB to handle your data safely - you can submit your email address and phone number to https://transparentadvertising.org/ https://transparentadvertising.org/. What does HN say, do we trust them for this?
- tyingq 4y ago
  It is "email address OR phone number" which is a little better...at least not giving them a free correlation. Though I suspect they usually already have it.
  - Tempest1981 4y ago
    Yep, "OR", just tried it: https://transparentadvertising.org/ https://transparentadvertising.org/ It displays this caution twice: "Note: this choice may limit your ability to access ad supported content."
- emsixteen 4y ago
  Things like this being opt-out make my skin crawl.
- nulbyte 4y ago
  Given they likely have everyone's Gmail address anyway, I have no problem opting mine out. I won't bother opting out my other addresses though; I doubt they correlate them all to the same person, since they are all different domains.
- acdha 4y ago
  I don’t trust them but since my info has been breached dozens of times by now I assume it’s public and rely on my spam filter.
alphadelphi 4y ago
It seems more like a move to make things work in a more effective way rather than a move in order to subtle ignore your will. The former can be a side effect, not so terrible if there is transparency and the ability to opt-out the tracking. I should be able to defend my privacy with some switches in a sort of "Manage cookie preferences" page/banner way and to going nuts adding some special chars in my email address.
- dmitriid 4y ago
  > It seems more like a move to make things work in a more effective way rather than a move in order to subtle ignore your will. You are talking about IAB. At no point in the process is IAB is concerned about you, the user. This move is intentional. BTW they've already been fined for other scummy behaviour https://proprivacy.com/privacy-news/iab-consent-popups-ruled-illegal https://proprivacy.com/privacy-news/iab-consent-popups-ruled...
antonyh 4y ago
I run with a custom domain and a catch-all email rule, so all inbound mail goes to the same inbox, so I can use whatever@domain.com. Maybe it's still trackable but at least helps identify leaks.
- maccard 4y ago
  How many leaks have you found with this approach?
  - oddlama 4y ago
    Not parent, but I'm doing the same thing and I have had 5 leaks out of (currently) 387 accounts over the past 4 years (which is when I started doing this). Oh and none of the involved entities ever acknowledged the leaks. I'd also be highly interested in the rates other people encounter.
    - jrochkind1 4y ago
      The "leak" could be the company selling their email list, yes?
      - martin_a 4y ago
        Or some kind of involuntarily passing on the mail addresses, like a breach of some kind.
        jrochkind1 4y ago
        Could be. If they sold the email addresses, that is one reason they would not "disclose" it, it was just routine business (and not business they are eager to disclose, although I suppose it's mentioned in some fine print in their privacy statement somewhere, hypothetically, maybe).
    - ttyprintk 4y ago
      I haven’t counted, but have had a similar rate over 10 years.
niknetniko 4y ago
Am I missing something here? I understand the "The IAB loves tracking users." part of the title, but where is the part about "But it hates users tracking them."? Based on the title, I would have expected an exception in their standard for themselves, or a story about how their own user tracking technology was used against them. However, there is none of that. Just that the IAB does not want to make it easier for users to escape their tracking (which, given their purpose, is unfortunately entirely expected). What justifies "But it hates users tracking them."?
- edent 4y ago
  It was a quicker way of me writing "but hates users being able to track what their members are doing with user data". The reason my email address for this site is `+ycombinator@...` is that I can track when dang decides to go rogue and sell my email to a Nigerian Prince. Think of it like sousveillance.
  - rchaud 4y ago
    Have you ever received any spam addressed to that account? I've signed up for countless services over the past decade, the only ones to ever spam me were university consulting groups back from the time I was applying to grad school.
    - edent 4y ago
      Yes. I frequently find services which - either maliciously or through incompetence - allow my email to be used for 3rd party spam. Even some big companies aren't immune to a dodgy contractor walking off with a contact list.
- rpdillon 4y ago
  I suspect that part of the title is referring to the section that discusses using different email addresses for different services, so you can tell who sold your email address.
- fluidcruft 4y ago
zinekeller 4y ago
I genuinely thought that the title meant that trying to request comments or positions about ad technologies to IAB will result to basically "I cannot reach IAB", but the content is not that. Now, on the topic, this basically violates GDPR (anything that would reasonably allow individual identification needs consent and the user must be able to object to it). Also, I'm not saying the workaround here, but assuming that you still want to use GMail (seriously?) this can still be frustrated (hint: Garfield Mail). https://github.com/IABTechLab/uid2docs/tree/main/api#email-address-normalization https://github.com/IABTechLab/uid2docs/tree/main/api#email-a...
dale_glass 4y ago
> As part of the UID2 API they specifically describe how an advertiser must "normalise" their users' email addresses. > > This means h.a.n.solo+iab@gmail.com becomes plain old hansolo@gmail.com It seemed to be completely obvious to me even decades back, that the + scheme would be trivially parsed and reversed. So I don't use it and just keep on making completely new aliases. So amazon gets amazon@example.com. If I'm not going to pay for anything on this account it also gets a random name from a random piece of well known media, like "Donald Duck", and all the data filled in randomly to ensure that it's not googleable, and doesn't correlate with any accounts anywhere else. The bigger issue I see is the desire to link everything to a phone number. Even stuff made for privacy, like Signal.
- 6510 4y ago
  how big is the website? ignore everything before @
- fluidcruft 4y ago
  Careful, if you use that at amazon, it's also completely trivial for amazon to notice and package you up as "@example.com" and flag "@example.com" on a central watchlist so others do the same. Although a trick could be if you setup your service to run "service+username@example.com" then depending on how they implement their normalization, they'll chop off the username for you and track themselves.
  - dale_glass 4y ago
    True, they could do that, but I highly doubt that it's a common enough practice for the industry to bother. And it still has the advantage that I can remove an alias and it's not obvious what the main account it leads to is.
  - maeil 4y ago
    What are you suggesting they would use such a central watchlist for? It's not like they're going to deny service to those who have "amazon" in their email address. And what kind of centralization are you talking about? Sharing it with other companies? I'm as pessimistic about these things as they come but even to me that seems incredibly unlikely.
drcongo 4y ago
I honesty think the only way to deal with organisations like this is to publicly post their names and addresses and encourage the general public to follow them around in real life, everywhere they go. Crowds of people following them round the supermarket watching what they put in their basket might finally make them realise what they're doing.
- ravel-bar-foo 4y ago
  An analogue of this might make a very interesting California ballot measure: All bills which gather or correlate data must be applied such that their provisions first be applied to legislators. Or something like that
- rchaud 4y ago
  Who's first? Eric Schmidt? Zuckerberg? Dorsey? There's a reason these people live in gated communities and don't let their kids use their apps.
  - Nextgrid 4y ago
    > There's a reason these people live in gated communities and don't let their kids use their apps. Given the turmoil that the "Elon Jet Tracker" created it seems like tracking still pisses these people off despite their wealth and gated communities/etc. Time for trackers for pro-tracking execs, politicians and incompetent regulators (such as the previous head of UK's privacy regulator who did zero substantial enforcement during 4 years of blatant GDPR breaches, or whoever is heading the corrupt Irish DPA who's in cahoots with Facebook)?
  - hooverd 4y ago
    The IAB does publicly list their membership. It's mostly tech execs, but none of the big dogs. https://www.iab.com/our-story/ https://www.iab.com/our-story/
- InCityDreams 4y ago
  "I see you just bought a $400 musical keyboard. Would you like to purchase more $400 keyboards?" Happening to me at the moment.
ppetty 4y ago
Fastmail's masked email, in addition to iCloud's hide my email, are great alternatives to massaging your address with a . or a + ... Both of those require payment. I'm really really happy with Fastmail (and use iCloud too), but wonder what the allure of Gmail still is (other than cost)?
- TeMPOraL 4y ago
  > what the allure of Gmail still is (other than cost)? You need one to use Play Store on Android. At least I think you need a GMail one. Even if not, the Play Store and the Android OS itself make it seem like you need one, from the second you turn a brand new phone on. The funneling is quite heavy here. (Heavy enough that almost everyone in my family uses a GMail account mostly just for the Play Store. My wife and I pay for Fastmail, some of other members of my immediate family have primary e-mail with a local free mail provider, but everyone found it easier to use an old (or make a new) Google account with their Android phones, instead of figuring out how to make it work with non-Google e-mail.)
  - viscountchocula 4y ago
    No, you need a Google account, but that can use an email address from any domain.
  - jeroenhd 4y ago
    You can create a Google account with any domain. I've got a Google account for my Outlook address and a Microsoft account for my Gmail address. This greatly confuses the Gmail and Outlook web UI but the accounts work.
- benhurmarcel 4y ago
  DuckDuckGo offers the same service for free if you prefer.
mxkopy 4y ago
I love the language > UID2 is a framework that enables deterministic identity for advertising opportunities on the open internet for many participants across the advertising ecosystem. Can we get stochastic therapeutic benefit from watching them thrive as a tight knit community in cutting edge plexiglass dormitories, please?
ribit 4y ago
I used google's "+" addresses for a while, but it was obvious that this wouldn't last. Apple's disposable email addresses are a great tool to solve this once and for all.
- adwww 4y ago
  What happens if you stop paying for the iCloud service? Obviously you won't be able to create new hidden addresses, but do the old ones continue to receive mail?
- danaris 4y ago
  It's not a Google-specific feature; it's part of the email spec (albeit an optional one). iCloud email supports them too, and I've been using them on both my Gmail and iCloud emails for a while now.
secondcoming 4y ago
I assume that the person who replied to the github issue actually works for The Trade Desk, not the IAB. UID2 came from TTD IIRC.
Kon-Peki 4y ago
Interesting. Back in the invite-only beta days, I signed up for a firstName.lastName@gmail.com address. It appears that years later someone else signed up using the same first and last name but without the dot, and that they are distinct gmail accounts.
- imp0cat 4y ago
  Gmail does not work like that, dots are ignored. firstName.lastName@gmail.com and firstNamelastName@gmail.com are both the same address. https://support.google.com/mail/answer/7436150?hl=en https://support.google.com/mail/answer/7436150?hl=en
  - Kon-Peki 4y ago
    Ok, fair enough. The other alternative might be even worse. This account has become my junk address, because I can’t trust it.
    - ProllyInfamous 4y ago
      In my situation, "the other guy" ends up using MY first.last@g as HIS spam email; this has led to some embarrassing FWDs to his wife [from me], as he mistakenly provided their home phone number in to one of his spammers (so I got it, as he had used my email [instead of his] to keep spam out of his inbox). Too much fun, telling his wife about his porn-viewing habits and other miscellaneous secrets. I don't use email anymore, but I maintain this account just because it pisses him off... I think this high-up at some tech company (that shares my same name) secretly expects me to just hand over the account I signed up for fifteen years ago, now... not happening, Mr. S.
Tepix 4y ago
Here we have a great example of an advantage of running your own mail server. You like subaddressing? Just use a different "recipient_delimiter" in your configuration - almost endless possibilities!
r3trohack3r 4y ago
PSA: many (most?) paid email providers allow catch-all email addresses on your own domain. I use this to give ever vendor their own personal email address: hn@foobar.com, github@foobar.com, twitter@foobar.com, homedepot@foobar.com, etc. I currently use Protonmail and have been very happy with them, though I’ve been eyeing Hey!.
- MoOmer 4y ago
  I switched to Fastmail and love it, for business and personal. It’s so easy to add/filter/map/organize many domains/aliases per account.
  - wpietri 4y ago
    I'll second Fastmail. They do subdomain addressing, which is cool: https://www.fastmail.help/hc/en-us/articles/360060591053-Plus-addressing-and-subdomain-addressing https://www.fastmail.help/hc/en-us/articles/360060591053-Plu... And they allow arbitrary rules for processing incoming mail, so you can use characters other than the plus sign. And you can also take addresses that have been compromised by spammers and route them right to your spam trainer, so that spammers help improve your defenses.
pard68 4y ago
I have a catch-all setup so any email sent to my domain, that is not a registered email, goes to a specific account. Then I just create a new email for each site. I also use Sieve rules (Fastmail) to process emails. Each email address for a specific site uses that site's dns name (amazon.com@foo.tld). If an email is sent to an address and the sender's domain doesn't match the left side of the "@" (with or without dots) than it's considered spam and I send myself an email saying someone likely sold my data. Works great with Bitwarden's new username generation feature. I can create new accounts in a push of a button now.
- wpietri 4y ago
  Ooh, I love the automatic comparison of destination address with sender address. Would you mind sharing your Sieve rules for this?
  - pard68 4y ago
    Here is the relevant part of my sieve rule. Just know that you can switch the :contains to :is this would make it so the localpart would have to match the sender domain exactly. I'd do this but I initially wasn't using the full dns name for my localparts: # Account sorting set "domain_name" "acct.ninja"; if address :domain "To" "${domain_name}" { if address :localpart :matches "To" "+" { set :lower :upperfirst "addr" "${1}"; set :lower :upperfirst "subaddr" "${2}"; if not address :domain :contains "From" "${addr}" { fileinto :create "SPAM"; } else { fileinto :create "INBOX.Accounts.${addr}.${subaddr}"; } stop; } elsif address :localpart :matches "To" "*" { set :lower :upperfirst "addr" "${1}"; if not address :domain :contains "From" "${addr}" { fileinto :create "SPAM"; } else { fileinto :create "INBOX.Accounts.${addr}"; } stop; } }
    - wpietri 4y ago
      Very interesting! I hadn't thought of having specific folders by the tag. I'll have to look carefully at my incoming mail and see how I can adapt this. Thanks!
  - 4y ago
Nextgrid 4y ago
In addition to this kind of tracking (unless explicitly opt-in with a compliant consent flow without any dark patterns) being in breach of the GDPR, I wonder if such mangling of the e-mail address would also be in breach of the right to rectification? Let's assume you willingly opt-in to tracking but for whatever reason want to be tracked under "h.a.n.solo+iab@example.com" and not "hansolo@example.com" (because maybe example.com doesn't strip out + and . characters, so the two addresses are actually separate users), them not allowing you to change it back to your real address (without their normalisation process) might be a breach of the right to rectification as they'd be holding inaccurate personal data about you. Of course this is all completely philosophical as GDPR enforcement is not only severely lacking but is nowhere near technical enough to dig into such detail.
- marcosdumay 4y ago
  I imagine you can't rectify a UUID I associate with your account. The same way, you can't rectify a normalized email field that has the correct email, but normalized.
imglorp 4y ago
There are also privacy email blockers for exactly this purpose too, eg: https://spreadprivacy.com/protect-your-inbox-with-duckduckgo-email-protection/ https://spreadprivacy.com/protect-your-inbox-with-duckduckgo...
propogandist 4y ago
this isn’t just IAB, this was noted as standard behavior for large data brokers by a privacy researcher [1] years ago Email and phone number matching is part of their core service offered by Oracle’s Bluekai, one the largest data-broker platforms in the world [2]. They have most large global companies using their platform. > You can convert users' email addresses and phone numbers to SHA-256 hashed IDs called oHashes and send them to the platform. They will be synchronized with the network of user profiles that are linked together in the Oracle ID Graph, which is used to manage IDs and user attributes for all Oracle Data Cloud platform customers. > This synchronization optimizes the targeting and communication of your users across desktop and mobile devices and media execution platforms. oHashes enable you to increase your offline to online match rates, connect your Responsys platform to the Oracle Data Cloud platform, and execute cross-device targeting. … > the [normalization / oHash] function enforces UTF-8 character encoding, lowercases all characters in the email address, verifies that it has the “@” symbol, and removes all special characters, punctuation, and spaces. … Both Google and FaceBook also expect clients to send phone + email (hashed) to build retargeting lists from customer data. They each have a different name for the feature [3] [1]https://twitter.com/WolfieChristl/status/1288467207333318656?s=20 https://twitter.com/WolfieChristl/status/1288467207333318656... [3] https://twitter.com/WolfieChristl/status/1288252803341783041?s=20 https://twitter.com/WolfieChristl/status/1288252803341783041... [2]https://docs.oracle.com/en/cloud/saas/data-cloud/data-cloud-help-center/IntegratingBlueKaiPlatform/IDManagement/sending_ohashes.html https://docs.oracle.com/en/cloud/saas/data-cloud/data-cloud-...
toss1 4y ago
I wonder if there is a way to poison the system. E.g., flood it with accounts that look very attractive to bidders so they pay a lot for adverts that never pay anything. I'm fine with context-based adverts based on and next to the content I'm reading, and have actually found some good products & services that way. But the tracking is not ok in any form (and from what I've read, basically doesn't work and is also defrauding the advertisers), so anything to destroy that model would be a net benefit to society.
- cldellow 4y ago
  The only real solution is an ad blocker. I worked at an ad tech company. We all ran ad blockers. The hypocrisy is through the roof. This is the best solution because it severely negatively affects the ecosystem. Publishers make less, so they crank up the ad density for the remaining users. That increases user resentment and suppresses the per-ad cost, enabling much crappier ads to run on the website. That also increases user resentment and suppresses the per-ad cost, and the glorious cycle continues.
  - Nextgrid 4y ago
    Wouldn't something like AdNauseam be better? Even if the anti-abuse mechanisms successfully detect it, it would still consume resources, which seems better than simply blocking the ads? Plus if your IP/browser fingerprint gets blacklisted you may end up in a situation where you get banned from further ads and may not even need as much blocking/etc as advertisers preemptively block you?
    - dns_snek 4y ago
      While I love the idea, I decided against AdNauseam because I was worried about Google AI labeling my account and/or IP as perpetrator of click fraud and banning my (or others') personal or work accounts in retaliation. It's not something I ever want to deal with or have to explain to someone else.
    - cldellow 4y ago
      Run it if you want. But if you run AdNauseam, people are still getting paid. The publisher, the ad network, the ad agency. The advertiser is getting screwed, but the other parties will work really hard to explain it away to them. "You're getting great engagement with the creative -- you clearly just need to improve the landing page experience." For me, my balance is that I'll run an ad blocker and whitelist sites that (a) create original content and (b) don't abuse me as a viewer.
superlupo 4y ago
IAB will try to do everything to go pre-GDPR, where it could track users across the whole web. Without explicit consent, forwarding an ID like e-mail address is illegal, of course.
1letterunixname 4y ago
The fun part is people with similar emails being conflated together as 1 "person". Good luck with these assumptions and the wrath of customers.
1letterunixname 4y ago
Once upon a time, i used a catchall @domain and it was trivial to track email disclosures. I think it's more private to maintain an individual alias as a throwaway proxy address per service, but it's more work.
laserdancepony 4y ago
Honestly, I don’t know how we’re going to get advertising under control anymore. Nothing that’s not an all-out ban and then allowing a select subset.
nhchris 4y ago
I was hoping "tracking the IAB" meant names and addresses of its key members. Fighting an amorphous organization is hopeless - targeting people is far more effective.
- YoshiRulz 4y ago
  Well, if you know which users are part of this GitHub organisation (their public member list is empty, ironically), you might be able to grab their real emails from their Git commits. What you do with them I'll leave up to your imagination... The specific user who responded with "we thought long about this update and ultimately as it stands today it is not a change we would like to add" uses their @users.noreply.github.com email for Git, but their employer and hometown are public on their profile, and a quick search gives you the mail address. While I live nearby, I don't intend on paying them a visit, plus it seems to be a shared office highrise, but I might just write them a strongly-worded letter.
intc 4y ago
Our self hosted email service, https://c1.fi https://c1.fi, works fine with "plus addressing". In addition I recently laid out plans for "disposable aliases" with a machine generated random string as local part for users in our shared domains (like c1to.me). So one could use an alias when signing-up with a service. Once the service is not relevant - Just delete the alias. All comments and suggestions are welcome. =)
- pwdisswordfisha 4y ago
  You should make your website work without JavaScript.
  - intc 4y ago
    Thanks fore commenting! The public informative parts of c1.fi are readable without JS. See https://c1.fi/about?lang=en https://c1.fi/about?lang=en for example. Registering, account management etc. will require JS - Simply to provide better UX. There are no 3rd party libraries or references (except on pages handling payments via Stripe) in use and the JS is not minified. No 3rd party trackers either.
    - account42 4y ago
      > Registering, account management etc. will require JS - Simply to provide better UX. The proper way to do that is progressive enhancement. Receiving a proken page and demands to turn on JS is pretty much the worst UX you can come up with.
mensetmanusman 4y ago
When your email becomes your identity, google has more power.
djhworld 4y ago
I really want to like the gmail trick with . and + but I've run into issues many times with websites that don't share validation code between registering for a service and logging in. I've had situations where I've been able to register for something fine, but the login form breaks saying + is not valid. This often leads to having to call customer services and explain to a confused rep the situation. Additionally as others have mentioned I'd imagine a lot of websites who do permit these addresses are already "normalizing" the address anyway and storing that instead
- jjav 4y ago
  > I really want to like the gmail trick with . and + This is not a gmail trick. It has been in common usage at least since the very early 90s (but may predate that), it was a fairly universal convention.
  - jeroenhd 4y ago
    It's not universal, though. When my local university switched over from Gmail to Office 365, they made the ingenious decision to disable + aliases at the same time. Emails to unknown addresses are rejected like any non-existent email address. This means that anyone who registered an account with a + address could no longer access their services. Hope nobody forgets their password for that one critical service that doesn't let you change your email address!
gumby 4y ago
I clicked on the link as I was confused by the headline, assuming that "IAB" meant "Internet Architecture Board". TLA collisions of the nerds.
remote_phone 4y ago
I use my name to differentiate different suppliers of my information. I have a spam-only email account but my name is what I use to differentiate between different companies because there’s no way they can filter that.
yellowapple 4y ago
The blatant user-hostility aside, not all mailservers / email providers use plus-aliasing, so "normalizing" email addresses in this way can and will cause emails to go nowhere - or worse, to the wrong person. This sort of "normalization", being both just plain evil and just plain stupid, is grounds for me to never touch a system attempting it with a 10 foot pole - and grounds for me to apply the same treatment to such a system's creators. If you are simultaneously too evil and too stupid to understand that email address normalization is a horrible idea that should never ever be done, then I want nothing to do with you. If you think that comes across as rude and uncivil, well, so does mangling the email address I supply (and violating multiple IETF RFCs in the process) for the sake of surveillance and spam.
- Xylakant 4y ago
  It’s not a problem for email since they never intend to send an email to the normalized address. All they want to use it for is to connect two separate identities. The worst case from their perspective is that two actually unrelated people share one advertising profile - I’d think they consider that an acceptable loss.
  - yellowapple 4y ago
    > The worst case from their perspective is that two actually unrelated people share one advertising profile Meaning that I get spammed with AARP ads everywhere I go because my email address gets "normalized" to be the same as Grandpa George... and we both get spammed with Bad Dragon ads everywhere we go because both our email addresses get "normalized" to be the same as Dildo Daddy Dave. Fuck that and the horse it rode in on. Targeted advertising is a blight on society.
    - Xylakant 4y ago
      > Fuck that and the horse it rode in on. Targeted advertising is a blight on society. I agree. But I doubt they care.
m3047 4y ago
They've settled on a set of features and non-features, similar to how we do it with threat indicators. If it's error prone for threat indicators it's error prone for user tracking and vice versa. There are reasons not to care. For instance in the threat indicator space false negatives (a threat which is not caught) doesn't cause nearly the pucker as a false positive (something which is not a threat which is flagged as one). Their calculus and minimum may be driven by somewhat different objectives, because their audience is advertisers not security practitioners. You can still 1:1 addresses to purposes and if you see crosstalk you can draw conclusions. Their normalization is lossy; that's the point. The cynic in me notes that given the absolute lack of originality in password choice, similar lack of entropy could be seen in 1:1 mappings and perhaps they can infer that if you're hansolo@ and they're example.com, that the email address you'd use is han.solo+example@. The cynic also says: that's on you. But damn, I'm looking better all the time: https://github.com/m3047/trualias https://github.com/m3047/trualias
raincom 4y ago
Use these services: HideMyEmail on iOS masked emails on Fastmail Firefox relay DuckDuckGo email protection
wistlo 4y ago
What about owning a domain and using a unique address for each commercial entity? FOr example, amazon@mydomain.us, nytimes@mydomain.us, citibank@mydomain.us, etc. I have done this for years, but now gmail recipients are rejecting my email as spam. (I've gone through multiple iterations with the DNS configuration at the host, but fundamentally the IP address is tainted other customers on this provider using it to send spam. I shouldn't have to fork up for a dedicated whitelisted IP address just to get functional email). As a result now I have a dedicated @gmail.com address just for those folks and businesses. I'm surprised the world, and most especially the tech community, embraced gmail so quickly. Yes, it's a great interface, yes, it's free, but from the start they said they would be scanning content and collecting infomation from email content. WHy are we OK with that?
- curiousgal 4y ago
  The downside is when I have to reach out to customer support re my account. I can only send emails from my main address.
  - propogandist 4y ago
    Fastmail supports the ability to send outbound mail from the email address the mail was sent to that may be of interest to you.
  - Tepix 4y ago
    With Thunderbird you can edit your email address before sending. It used to be even more comfortable using the "virtual identity" extension its author gave up maintaining it after Thunderbird 68 https://www.absorb.it/virtual-id/ https://www.absorb.it/virtual-id/
    - account42 4y ago
      Thunderbird can also automatically select the reply from address based on the original to address but afaict only for addresses you have configured and not for whole catch-all domainst - I guess that is something the extension allowed? Sometimes I wonder if Mozilla don't realize of what their extension API redesigns are costing the world or if their just don't care...
Animats 4y ago
Since I dropped my Google and Facebook accounts, and blocked all Google and Facebook tracking, I don't get spammed much. I'm not anonymous. I have patents, trademarks, D/B/A names, and domains with my real name and address. No spam. Maybe once a year, a paper letter. I'm on Github, Mastodon, and PeerTube. No spam. I still get some spam. It's totally mis-targeted. Currently in my spam folder: Ads for edible oil can filling equipment, and for ammonium sulfate nitrate fertilizer from China. I don't farm. Spammers just don't seem to bother with targets not tracked by Google and Facebook any more. It's an upside to the ad monopoly.
- deleted 4y ago
  [deleted]
- tgtweak 4y ago
  >or ammonium sulfate nitrate fertilizer from China. I don't farm. "Not on facebook or google... must be a farmer"
pixeldetracking 4y ago
Thanks for sharing this! From the IAB, I'm not surprised unfortunately Normalize emails is "best practice" for all the dirty "unique identifiers" players, see ID5 for example https://support.id5.io/portal/en/kb/articles/passing-partner-data-to-id5#Deriving_the_Partner_Data_pd_Value https://support.id5.io/portal/en/kb/articles/passing-partner...
1vuio0pswjnm7 4y ago
"Personally, I recommend installing the uBlock advert blocker on all devices which support it." NB. I am a casual use of uBlock. I have nothing against it. However like other alternatives it may have limitations that are worth considering. At the very least we have to consider devices and applications that do not support uBlock Matrix/Origin. With respect to those that do support it, a company making large profits from advertising that controls a particular application, like a web browser, or that controls a particular operating system, like a graphical mobile or desktop one that no user ever compiles themselves, can "remove support" for uBlock at any time. Options for setting a default gateway and setting DNS servers are arguably even more prevalent on devices than support for uBlock. Presumably companies making large profits from advertising could remove support for DNS settings and default gateways from the operating systems they control, however this seems much less likely.^1 Where no user-configurable firewall is available on the device, we can sometimes use DNS settings, i.e. wildcards, to point DNS traffic to a DNS server we control. We can configure the DNS server to block/allow certain DNS traffic. We can also use the DNS server to point all HTTP traffic to the proxy. The DNS server and the proxy can be running on the loopback of the device or they could be running on the gateway, where the gateway is another computer that we control. What is needed to disrupt this UID API from IAB. Is DNS enough. Do we need to filter URLs for certain JS files. Do we need to filter cookies. "All UID2 endpoints use the same base URL. Environment Cloud_Region Code_Base_URL Testing AWS US East (Ohio) us-east-2 https://operator-integ.uidapi.com https://operator-integ.uidapi.com Production AWS US East (Ohio) us-east-2 https://prod.uidapi.com https://prod.uidapi.com Production AWS Asia Pacific (Sydney) ap-southeast-2 https://au.prod.uidapi.com https://au.prod.uidapi.com Production AWS Asia Pacific (Tokyo) ap-northeast-1 https://jp.prod.uidapi.com https://jp.prod.uidapi.com Production AWS Asia Pacific (Singapore) ap-southeast-1 https://sg.prod.uidapi.com https://sg.prod.uidapi.com For example, https://operator-integ.uidapi.com/v2/token/generate https://operator-integ.uidapi.com/v2/token/generate" Source: https://github.com/IABTechLab/uid2docs/blob/main/api/v2/README.md https://github.com/IABTechLab/uid2docs/blob/main/api/v2/READ... In authoritative DNS, a wildcard entry such as *.uidapi.com 1 IN A 127.0.0.1 would send HTTP requests for these UID API endpoints to the loopback. This is is the same effect as using a hosts file like the StevenBlack one. Except some applications may ignore /etc/hosts. In dnscache, djb's recursive DNS server, creating a one line file like echo 127.0.0.1 > dnscache/root/servers/uidapi.com would send DNS lookups for these UID API endoints to the loopback. (NB. AFAIK, unbound does not by itself support wildcards.) What about uBlock. uBlock relies on certain lists maintained by various third parties. For example, https://raw.githubusercontent.com/StevenBlack/hosts/master/data/StevenBlack/hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/d... https://codeload.github.com/easylist/easylist/zip/refs/heads/master https://codeload.github.com/easylist/easylist/zip/refs/heads... https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-online.txt https://malware-filter.gitlab.io/malware-filter/urlhaus-filt... https://raw.githubusercontent.com/gorhill/uBlock/master/assets/assets.json https://raw.githubusercontent.com/gorhill/uBlock/master/asse... (lists contained therein) I perused some of these lists looking for the uidapi.com endpoints. It's possible I missed something but I only got one result: cdn.uidapi.com in the StevenBlack hosts file I think all the third party lists are great, however those require constant dillgence and there are so many now it is becoming confusing. Personally I find whitelists that I control are easier for me to manage. I also find that on Android, NetGuard is more useful than uBlock. They do different things. I find NetGuard is more versatile. The number of domains that I need to access is much smaller and grows at a slower rate than the number of domains on the internet that need to be "blocked". As is sometimes done in firewall rules, using DNS I "block" all domains by defult and add A records for the domains I actually need to access. 1. There are numerous open source operating system projects that could provide those traditional, basic features to any user who wanted them. As it happens, such companies have relied considerably on such non-commercial, open source projects to create their own commercial, advertising-friendly versions.
shortrounddev 4y ago
As someone who works for a DMP/DSP provider which implements UID2, Let me clarify 3 things 1. It is against IAB terms of service for partners to store a map of UIDs to PII (email and phone). Many clients do NOT want to share PII with DMPs, and so IAB also allows clients to submit SHA-2 hashed PII for identification. So if you are afraid of UID implementations selling your email, all I can say is that its against the terms of service to do so in conjunction with a UID 2. UID2 DSP Workflow implementations must provide an opt-out endpoint to them so that your UID won't be used in targeted advertising if you choose. This does not require them to purge your UID from their records or any info associated with it, but they must ignore that info in bid requests if you have requested to opt-out. 3. IAB is currently the main provider of UID2, but the system is designed so anyone can become a provider. IAB may not be the one handling your PII or UID. It is intended to be a decentralized system to solve the coming death of proprietary 3rd party tracker cookies. Philosophically, we the users must accept that the price of free content is advertisement. If we want to continue to receive content, we must consent to some level of tracking and targeted advertising, or we must become okay with paying a monthly subscription for internet content. Without targeted advertising and a decentralized RTB ecosystem, there is no open internet; Google and Facebook will dominate everything, and small sites will be unable to compete
- account42 4y ago
  > 3. IAB is currently the main provider of UID2, but the system is designed so anyone can become a provider. IAB may not be the one handling your PII or UID. It is intended to be a decentralized system to solve the coming death of proprietary 3rd party tracker cookies. And you realize that third party cookies are gong away because people don't want to be tracked across different organizations, right? That means working around that limitation is the IAB and those working with them being actively malicious. > Philosophically, we the users must accept that the price of free content is advertisement. Nope. > If we want to continue to receive content, we must consent to some level of tracking and targeted advertising, or we must become okay with paying a monthly subscription for internet content. Absolutely not. It is human nature to create and to share. People have always created and shared - long before parasites like the advertisement industry have inserted themselves into that process. This argument is even more ridiculous for the internet where content is primarily created by users which receive no or almost no revenue from the ads shown by the platforms hosting their work. > Without targeted advertising and a decentralized RTB ecosystem, there is no open internet; There was an open internet before targeted advertisement. > Google and Facebook will dominate everything, and small sites will be unable to compete Google and Facebook are advertising companies. They dominate because of advertising.
paledot 4y ago
I remember a time when websites like AltaVista and Lycos would have column after column of checkboxes in the user settings, requesting that you check which categories of ads interested you.

391 points by edent 4y ago

Email relays are the future. I use the one that comes with my Apple+ subscription, but I think there are others. Basically, per domain emails that fwd to your real email.

Hippocrates 4y ago

This is a great case for using iCloud “hide my email.” Curiously, I tried using it with “sign in with Apple” on slack and slack rejected it as a “hidden email.” I was able to circumvent that by using the regular sign in flow with a pre-generated “hide my email” address.

dkdbejwi383 4y ago
> and slack rejected it as a “hidden email.” Wow, that's pretty scummy behaviour! I wonder what the rationale is behind this?
- crote 4y ago
  Spammers and scammers. People are constantly trying to use any service for illicit purposes. A somewhat-easy way to deal with that is to just ban them. Because an email address is used as username and an email address usually maps 1:1 to a person, this means you just got rid of a Bad Person. This breaks if access to new email addresses is trivial. You now have to invest actual effort into validating that a new account isn't someone trying to do bad stuff. Or you can just block all the services providing easy access to email addresses and outsource the issue to big providers like GMail and Apple. It's a lot less effort, and you'll lose near-zero legitimate customers...
  - mthoms 4y ago
    True, but Apple's hidden emails are tied to a real credit card (not free) and can't be generated in bulk (AFAIK). I'm not inclined to give any service the benefit of the doubt here until there is some evidence that Apple emails are indeed being used for this purpose. I haven't seen any such evidence (but I'm open to it).
- eclipticplane 4y ago
  Slack gets used as Command and Control servers for malware and bot networks -- same as Discord. They are commonly installed so their network traffic isn't suspicious. They're also free. Blocking "hidden email" services is an easy first line of defense. You also can't register with mailinator.com email, for example.
  - mthoms 4y ago
    Apple's hidden emails aren't free. They are tied to a credit card and a phone number. It seems to me they are less likely to be abused than gmail.
crossroadsguy 4y ago
I think only those users use Apple’s HideMyEmail who have promised themselves to forever use Apple devices and forever having the paid plan, and never want to start a mail conversation from any of those emails. For others a domain, a mail provider works best with catch-all.
thewebcount 4y ago
How can they tell any iCloud address is a “hide my email” address? They generally use real words plus a number. Something like coffee_bike57@icloud.com. That seems like something a real human could also think up.
- jackson1442 4y ago
  when you do it through Sign in with Apple (not the autofill field on your keyboard) it looks more like oalshjidfa9378rha@privaterelay.apple.com
benhurmarcel 4y ago
For those who don't use iCloud, DuckDuckGo also has the same service with @duck.com emails.

llimos 4y ago

> If you want to opt out of this - and you trust the IAB to handle your data safely - you can submit your email address and phone number to https://transparentadvertising.org/ https://transparentadvertising.org/. What does HN say, do we trust them for this?

tyingq 4y ago
It is "email address OR phone number" which is a little better...at least not giving them a free correlation. Though I suspect they usually already have it.
- Tempest1981 4y ago
  Yep, "OR", just tried it: https://transparentadvertising.org/ https://transparentadvertising.org/ It displays this caution twice: "Note: this choice may limit your ability to access ad supported content."
emsixteen 4y ago
Things like this being opt-out make my skin crawl.
nulbyte 4y ago
Given they likely have everyone's Gmail address anyway, I have no problem opting mine out. I won't bother opting out my other addresses though; I doubt they correlate them all to the same person, since they are all different domains.
acdha 4y ago
I don’t trust them but since my info has been breached dozens of times by now I assume it’s public and rely on my spam filter.

alphadelphi 4y ago

It seems more like a move to make things work in a more effective way rather than a move in order to subtle ignore your will. The former can be a side effect, not so terrible if there is transparency and the ability to opt-out the tracking. I should be able to defend my privacy with some switches in a sort of "Manage cookie preferences" page/banner way and to going nuts adding some special chars in my email address.

dmitriid 4y ago
> It seems more like a move to make things work in a more effective way rather than a move in order to subtle ignore your will. You are talking about IAB. At no point in the process is IAB is concerned about you, the user. This move is intentional. BTW they've already been fined for other scummy behaviour https://proprivacy.com/privacy-news/iab-consent-popups-ruled-illegal https://proprivacy.com/privacy-news/iab-consent-popups-ruled...

antonyh 4y ago

I run with a custom domain and a catch-all email rule, so all inbound mail goes to the same inbox, so I can use whatever@domain.com. Maybe it's still trackable but at least helps identify leaks.

maccard 4y ago
How many leaks have you found with this approach?
- oddlama 4y ago
  Not parent, but I'm doing the same thing and I have had 5 leaks out of (currently) 387 accounts over the past 4 years (which is when I started doing this). Oh and none of the involved entities ever acknowledged the leaks. I'd also be highly interested in the rates other people encounter.
  - jrochkind1 4y ago
    The "leak" could be the company selling their email list, yes?
    - martin_a 4y ago
      Or some kind of involuntarily passing on the mail addresses, like a breach of some kind.
      - jrochkind1 4y ago
        Could be. If they sold the email addresses, that is one reason they would not "disclose" it, it was just routine business (and not business they are eager to disclose, although I suppose it's mentioned in some fine print in their privacy statement somewhere, hypothetically, maybe).
  - ttyprintk 4y ago
    I haven’t counted, but have had a similar rate over 10 years.

niknetniko 4y ago

Am I missing something here? I understand the "The IAB loves tracking users." part of the title, but where is the part about "But it hates users tracking them."? Based on the title, I would have expected an exception in their standard for themselves, or a story about how their own user tracking technology was used against them. However, there is none of that. Just that the IAB does not want to make it easier for users to escape their tracking (which, given their purpose, is unfortunately entirely expected). What justifies "But it hates users tracking them."?

edent 4y ago
It was a quicker way of me writing "but hates users being able to track what their members are doing with user data". The reason my email address for this site is `+ycombinator@...` is that I can track when dang decides to go rogue and sell my email to a Nigerian Prince. Think of it like sousveillance.
- rchaud 4y ago
  Have you ever received any spam addressed to that account? I've signed up for countless services over the past decade, the only ones to ever spam me were university consulting groups back from the time I was applying to grad school.
  - edent 4y ago
    Yes. I frequently find services which - either maliciously or through incompetence - allow my email to be used for 3rd party spam. Even some big companies aren't immune to a dodgy contractor walking off with a contact list.
rpdillon 4y ago
I suspect that part of the title is referring to the section that discusses using different email addresses for different services, so you can tell who sold your email address.
fluidcruft 4y ago

zinekeller 4y ago

I genuinely thought that the title meant that trying to request comments or positions about ad technologies to IAB will result to basically "I cannot reach IAB", but the content is not that. Now, on the topic, this basically violates GDPR (anything that would reasonably allow individual identification needs consent and the user must be able to object to it). Also, I'm not saying the workaround here, but assuming that you still want to use GMail (seriously?) this can still be frustrated (hint: Garfield Mail). https://github.com/IABTechLab/uid2docs/tree/main/api#email-address-normalization https://github.com/IABTechLab/uid2docs/tree/main/api#email-a...

dale_glass 4y ago

> As part of the UID2 API they specifically describe how an advertiser must "normalise" their users' email addresses. > > This means h.a.n.solo+iab@gmail.com becomes plain old hansolo@gmail.com It seemed to be completely obvious to me even decades back, that the + scheme would be trivially parsed and reversed. So I don't use it and just keep on making completely new aliases. So amazon gets amazon@example.com. If I'm not going to pay for anything on this account it also gets a random name from a random piece of well known media, like "Donald Duck", and all the data filled in randomly to ensure that it's not googleable, and doesn't correlate with any accounts anywhere else. The bigger issue I see is the desire to link everything to a phone number. Even stuff made for privacy, like Signal.

6510 4y ago
how big is the website? ignore everything before @
fluidcruft 4y ago
Careful, if you use that at amazon, it's also completely trivial for amazon to notice and package you up as "@example.com" and flag "@example.com" on a central watchlist so others do the same. Although a trick could be if you setup your service to run "service+username@example.com" then depending on how they implement their normalization, they'll chop off the username for you and track themselves.
- dale_glass 4y ago
  True, they could do that, but I highly doubt that it's a common enough practice for the industry to bother. And it still has the advantage that I can remove an alias and it's not obvious what the main account it leads to is.
- maeil 4y ago
  What are you suggesting they would use such a central watchlist for? It's not like they're going to deny service to those who have "amazon" in their email address. And what kind of centralization are you talking about? Sharing it with other companies? I'm as pessimistic about these things as they come but even to me that seems incredibly unlikely.

drcongo 4y ago

I honesty think the only way to deal with organisations like this is to publicly post their names and addresses and encourage the general public to follow them around in real life, everywhere they go. Crowds of people following them round the supermarket watching what they put in their basket might finally make them realise what they're doing.

ravel-bar-foo 4y ago
An analogue of this might make a very interesting California ballot measure: All bills which gather or correlate data must be applied such that their provisions first be applied to legislators. Or something like that
rchaud 4y ago
Who's first? Eric Schmidt? Zuckerberg? Dorsey? There's a reason these people live in gated communities and don't let their kids use their apps.
- Nextgrid 4y ago
  > There's a reason these people live in gated communities and don't let their kids use their apps. Given the turmoil that the "Elon Jet Tracker" created it seems like tracking still pisses these people off despite their wealth and gated communities/etc. Time for trackers for pro-tracking execs, politicians and incompetent regulators (such as the previous head of UK's privacy regulator who did zero substantial enforcement during 4 years of blatant GDPR breaches, or whoever is heading the corrupt Irish DPA who's in cahoots with Facebook)?
- hooverd 4y ago
  The IAB does publicly list their membership. It's mostly tech execs, but none of the big dogs. https://www.iab.com/our-story/ https://www.iab.com/our-story/
InCityDreams 4y ago
"I see you just bought a $400 musical keyboard. Would you like to purchase more $400 keyboards?" Happening to me at the moment.

ppetty 4y ago

Fastmail's masked email, in addition to iCloud's hide my email, are great alternatives to massaging your address with a . or a + ... Both of those require payment. I'm really really happy with Fastmail (and use iCloud too), but wonder what the allure of Gmail still is (other than cost)?

TeMPOraL 4y ago
> what the allure of Gmail still is (other than cost)? You need one to use Play Store on Android. At least I think you need a GMail one. Even if not, the Play Store and the Android OS itself make it seem like you need one, from the second you turn a brand new phone on. The funneling is quite heavy here. (Heavy enough that almost everyone in my family uses a GMail account mostly just for the Play Store. My wife and I pay for Fastmail, some of other members of my immediate family have primary e-mail with a local free mail provider, but everyone found it easier to use an old (or make a new) Google account with their Android phones, instead of figuring out how to make it work with non-Google e-mail.)
- viscountchocula 4y ago
  No, you need a Google account, but that can use an email address from any domain.
- jeroenhd 4y ago
  You can create a Google account with any domain. I've got a Google account for my Outlook address and a Microsoft account for my Gmail address. This greatly confuses the Gmail and Outlook web UI but the accounts work.
benhurmarcel 4y ago
DuckDuckGo offers the same service for free if you prefer.

mxkopy 4y ago

I love the language > UID2 is a framework that enables deterministic identity for advertising opportunities on the open internet for many participants across the advertising ecosystem. Can we get stochastic therapeutic benefit from watching them thrive as a tight knit community in cutting edge plexiglass dormitories, please?

ribit 4y ago

I used google's "+" addresses for a while, but it was obvious that this wouldn't last. Apple's disposable email addresses are a great tool to solve this once and for all.

adwww 4y ago
What happens if you stop paying for the iCloud service? Obviously you won't be able to create new hidden addresses, but do the old ones continue to receive mail?
danaris 4y ago
It's not a Google-specific feature; it's part of the email spec (albeit an optional one). iCloud email supports them too, and I've been using them on both my Gmail and iCloud emails for a while now.

secondcoming 4y ago

I assume that the person who replied to the github issue actually works for The Trade Desk, not the IAB. UID2 came from TTD IIRC.

Kon-Peki 4y ago

Interesting. Back in the invite-only beta days, I signed up for a firstName.lastName@gmail.com address. It appears that years later someone else signed up using the same first and last name but without the dot, and that they are distinct gmail accounts.

imp0cat 4y ago
Gmail does not work like that, dots are ignored. firstName.lastName@gmail.com and firstNamelastName@gmail.com are both the same address. https://support.google.com/mail/answer/7436150?hl=en https://support.google.com/mail/answer/7436150?hl=en
- Kon-Peki 4y ago
  Ok, fair enough. The other alternative might be even worse. This account has become my junk address, because I can’t trust it.
  - ProllyInfamous 4y ago
    In my situation, "the other guy" ends up using MY first.last@g as HIS spam email; this has led to some embarrassing FWDs to his wife [from me], as he mistakenly provided their home phone number in to one of his spammers (so I got it, as he had used my email [instead of his] to keep spam out of his inbox). Too much fun, telling his wife about his porn-viewing habits and other miscellaneous secrets. I don't use email anymore, but I maintain this account just because it pisses him off... I think this high-up at some tech company (that shares my same name) secretly expects me to just hand over the account I signed up for fifteen years ago, now... not happening, Mr. S.

Tepix 4y ago

Here we have a great example of an advantage of running your own mail server. You like subaddressing? Just use a different "recipient_delimiter" in your configuration - almost endless possibilities!

r3trohack3r 4y ago

PSA: many (most?) paid email providers allow catch-all email addresses on your own domain. I use this to give ever vendor their own personal email address: hn@foobar.com, github@foobar.com, twitter@foobar.com, homedepot@foobar.com, etc. I currently use Protonmail and have been very happy with them, though I’ve been eyeing Hey!.

MoOmer 4y ago
I switched to Fastmail and love it, for business and personal. It’s so easy to add/filter/map/organize many domains/aliases per account.
- wpietri 4y ago
  I'll second Fastmail. They do subdomain addressing, which is cool: https://www.fastmail.help/hc/en-us/articles/360060591053-Plus-addressing-and-subdomain-addressing https://www.fastmail.help/hc/en-us/articles/360060591053-Plu... And they allow arbitrary rules for processing incoming mail, so you can use characters other than the plus sign. And you can also take addresses that have been compromised by spammers and route them right to your spam trainer, so that spammers help improve your defenses.

pard68 4y ago

I have a catch-all setup so any email sent to my domain, that is not a registered email, goes to a specific account. Then I just create a new email for each site. I also use Sieve rules (Fastmail) to process emails. Each email address for a specific site uses that site's dns name (amazon.com@foo.tld). If an email is sent to an address and the sender's domain doesn't match the left side of the "@" (with or without dots) than it's considered spam and I send myself an email saying someone likely sold my data. Works great with Bitwarden's new username generation feature. I can create new accounts in a push of a button now.

wpietri 4y ago
Ooh, I love the automatic comparison of destination address with sender address. Would you mind sharing your Sieve rules for this?
- pard68 4y ago
  Here is the relevant part of my sieve rule. Just know that you can switch the :contains to :is this would make it so the localpart would have to match the sender domain exactly. I'd do this but I initially wasn't using the full dns name for my localparts: # Account sorting set "domain_name" "acct.ninja"; if address :domain "To" "${domain_name}" { if address :localpart :matches "To" "+" { set :lower :upperfirst "addr" "${1}"; set :lower :upperfirst "subaddr" "${2}"; if not address :domain :contains "From" "${addr}" { fileinto :create "SPAM"; } else { fileinto :create "INBOX.Accounts.${addr}.${subaddr}"; } stop; } elsif address :localpart :matches "To" "*" { set :lower :upperfirst "addr" "${1}"; if not address :domain :contains "From" "${addr}" { fileinto :create "SPAM"; } else { fileinto :create "INBOX.Accounts.${addr}"; } stop; } }
  - wpietri 4y ago
    Very interesting! I hadn't thought of having specific folders by the tag. I'll have to look carefully at my incoming mail and see how I can adapt this. Thanks!
- 4y ago

Nextgrid 4y ago

In addition to this kind of tracking (unless explicitly opt-in with a compliant consent flow without any dark patterns) being in breach of the GDPR, I wonder if such mangling of the e-mail address would also be in breach of the right to rectification? Let's assume you willingly opt-in to tracking but for whatever reason want to be tracked under "h.a.n.solo+iab@example.com" and not "hansolo@example.com" (because maybe example.com doesn't strip out + and . characters, so the two addresses are actually separate users), them not allowing you to change it back to your real address (without their normalisation process) might be a breach of the right to rectification as they'd be holding inaccurate personal data about you. Of course this is all completely philosophical as GDPR enforcement is not only severely lacking but is nowhere near technical enough to dig into such detail.

marcosdumay 4y ago
I imagine you can't rectify a UUID I associate with your account. The same way, you can't rectify a normalized email field that has the correct email, but normalized.

imglorp 4y ago

There are also privacy email blockers for exactly this purpose too, eg: https://spreadprivacy.com/protect-your-inbox-with-duckduckgo-email-protection/ https://spreadprivacy.com/protect-your-inbox-with-duckduckgo...

propogandist 4y ago

this isn’t just IAB, this was noted as standard behavior for large data brokers by a privacy researcher [1] years ago Email and phone number matching is part of their core service offered by Oracle’s Bluekai, one the largest data-broker platforms in the world [2]. They have most large global companies using their platform. > You can convert users' email addresses and phone numbers to SHA-256 hashed IDs called oHashes and send them to the platform. They will be synchronized with the network of user profiles that are linked together in the Oracle ID Graph, which is used to manage IDs and user attributes for all Oracle Data Cloud platform customers. > This synchronization optimizes the targeting and communication of your users across desktop and mobile devices and media execution platforms. oHashes enable you to increase your offline to online match rates, connect your Responsys platform to the Oracle Data Cloud platform, and execute cross-device targeting. … > the [normalization / oHash] function enforces UTF-8 character encoding, lowercases all characters in the email address, verifies that it has the “@” symbol, and removes all special characters, punctuation, and spaces. … Both Google and FaceBook also expect clients to send phone + email (hashed) to build retargeting lists from customer data. They each have a different name for the feature [3] [1]https://twitter.com/WolfieChristl/status/1288467207333318656?s=20 https://twitter.com/WolfieChristl/status/1288467207333318656... [3] https://twitter.com/WolfieChristl/status/1288252803341783041?s=20 https://twitter.com/WolfieChristl/status/1288252803341783041... [2]https://docs.oracle.com/en/cloud/saas/data-cloud/data-cloud-help-center/IntegratingBlueKaiPlatform/IDManagement/sending_ohashes.html https://docs.oracle.com/en/cloud/saas/data-cloud/data-cloud-...

toss1 4y ago

I wonder if there is a way to poison the system. E.g., flood it with accounts that look very attractive to bidders so they pay a lot for adverts that never pay anything. I'm fine with context-based adverts based on and next to the content I'm reading, and have actually found some good products & services that way. But the tracking is not ok in any form (and from what I've read, basically doesn't work and is also defrauding the advertisers), so anything to destroy that model would be a net benefit to society.

cldellow 4y ago
The only real solution is an ad blocker. I worked at an ad tech company. We all ran ad blockers. The hypocrisy is through the roof. This is the best solution because it severely negatively affects the ecosystem. Publishers make less, so they crank up the ad density for the remaining users. That increases user resentment and suppresses the per-ad cost, enabling much crappier ads to run on the website. That also increases user resentment and suppresses the per-ad cost, and the glorious cycle continues.
- Nextgrid 4y ago
  Wouldn't something like AdNauseam be better? Even if the anti-abuse mechanisms successfully detect it, it would still consume resources, which seems better than simply blocking the ads? Plus if your IP/browser fingerprint gets blacklisted you may end up in a situation where you get banned from further ads and may not even need as much blocking/etc as advertisers preemptively block you?
  - dns_snek 4y ago
    While I love the idea, I decided against AdNauseam because I was worried about Google AI labeling my account and/or IP as perpetrator of click fraud and banning my (or others') personal or work accounts in retaliation. It's not something I ever want to deal with or have to explain to someone else.
  - cldellow 4y ago
    Run it if you want. But if you run AdNauseam, people are still getting paid. The publisher, the ad network, the ad agency. The advertiser is getting screwed, but the other parties will work really hard to explain it away to them. "You're getting great engagement with the creative -- you clearly just need to improve the landing page experience." For me, my balance is that I'll run an ad blocker and whitelist sites that (a) create original content and (b) don't abuse me as a viewer.

superlupo 4y ago

IAB will try to do everything to go pre-GDPR, where it could track users across the whole web. Without explicit consent, forwarding an ID like e-mail address is illegal, of course.

1letterunixname 4y ago

The fun part is people with similar emails being conflated together as 1 "person". Good luck with these assumptions and the wrath of customers.

1letterunixname 4y ago

Once upon a time, i used a catchall @domain and it was trivial to track email disclosures. I think it's more private to maintain an individual alias as a throwaway proxy address per service, but it's more work.

laserdancepony 4y ago

Honestly, I don’t know how we’re going to get advertising under control anymore. Nothing that’s not an all-out ban and then allowing a select subset.

nhchris 4y ago

I was hoping "tracking the IAB" meant names and addresses of its key members. Fighting an amorphous organization is hopeless - targeting people is far more effective.

YoshiRulz 4y ago
Well, if you know which users are part of this GitHub organisation (their public member list is empty, ironically), you might be able to grab their real emails from their Git commits. What you do with them I'll leave up to your imagination... The specific user who responded with "we thought long about this update and ultimately as it stands today it is not a change we would like to add" uses their @users.noreply.github.com email for Git, but their employer and hometown are public on their profile, and a quick search gives you the mail address. While I live nearby, I don't intend on paying them a visit, plus it seems to be a shared office highrise, but I might just write them a strongly-worded letter.

intc 4y ago

Our self hosted email service, https://c1.fi https://c1.fi, works fine with "plus addressing". In addition I recently laid out plans for "disposable aliases" with a machine generated random string as local part for users in our shared domains (like c1to.me). So one could use an alias when signing-up with a service. Once the service is not relevant - Just delete the alias. All comments and suggestions are welcome. =)

pwdisswordfisha 4y ago
You should make your website work without JavaScript.
- intc 4y ago
  Thanks fore commenting! The public informative parts of c1.fi are readable without JS. See https://c1.fi/about?lang=en https://c1.fi/about?lang=en for example. Registering, account management etc. will require JS - Simply to provide better UX. There are no 3rd party libraries or references (except on pages handling payments via Stripe) in use and the JS is not minified. No 3rd party trackers either.
  - account42 4y ago
    > Registering, account management etc. will require JS - Simply to provide better UX. The proper way to do that is progressive enhancement. Receiving a proken page and demands to turn on JS is pretty much the worst UX you can come up with.

mensetmanusman 4y ago

When your email becomes your identity, google has more power.

djhworld 4y ago

I really want to like the gmail trick with . and + but I've run into issues many times with websites that don't share validation code between registering for a service and logging in. I've had situations where I've been able to register for something fine, but the login form breaks saying + is not valid. This often leads to having to call customer services and explain to a confused rep the situation. Additionally as others have mentioned I'd imagine a lot of websites who do permit these addresses are already "normalizing" the address anyway and storing that instead

jjav 4y ago
> I really want to like the gmail trick with . and + This is not a gmail trick. It has been in common usage at least since the very early 90s (but may predate that), it was a fairly universal convention.
- jeroenhd 4y ago
  It's not universal, though. When my local university switched over from Gmail to Office 365, they made the ingenious decision to disable + aliases at the same time. Emails to unknown addresses are rejected like any non-existent email address. This means that anyone who registered an account with a + address could no longer access their services. Hope nobody forgets their password for that one critical service that doesn't let you change your email address!

gumby 4y ago

I clicked on the link as I was confused by the headline, assuming that "IAB" meant "Internet Architecture Board". TLA collisions of the nerds.

remote_phone 4y ago

I use my name to differentiate different suppliers of my information. I have a spam-only email account but my name is what I use to differentiate between different companies because there’s no way they can filter that.

yellowapple 4y ago

The blatant user-hostility aside, not all mailservers / email providers use plus-aliasing, so "normalizing" email addresses in this way can and will cause emails to go nowhere - or worse, to the wrong person. This sort of "normalization", being both just plain evil and just plain stupid, is grounds for me to never touch a system attempting it with a 10 foot pole - and grounds for me to apply the same treatment to such a system's creators. If you are simultaneously too evil and too stupid to understand that email address normalization is a horrible idea that should never ever be done, then I want nothing to do with you. If you think that comes across as rude and uncivil, well, so does mangling the email address I supply (and violating multiple IETF RFCs in the process) for the sake of surveillance and spam.

Xylakant 4y ago
It’s not a problem for email since they never intend to send an email to the normalized address. All they want to use it for is to connect two separate identities. The worst case from their perspective is that two actually unrelated people share one advertising profile - I’d think they consider that an acceptable loss.
- yellowapple 4y ago
  > The worst case from their perspective is that two actually unrelated people share one advertising profile Meaning that I get spammed with AARP ads everywhere I go because my email address gets "normalized" to be the same as Grandpa George... and we both get spammed with Bad Dragon ads everywhere we go because both our email addresses get "normalized" to be the same as Dildo Daddy Dave. Fuck that and the horse it rode in on. Targeted advertising is a blight on society.
  - Xylakant 4y ago
    > Fuck that and the horse it rode in on. Targeted advertising is a blight on society. I agree. But I doubt they care.

m3047 4y ago

They've settled on a set of features and non-features, similar to how we do it with threat indicators. If it's error prone for threat indicators it's error prone for user tracking and vice versa. There are reasons not to care. For instance in the threat indicator space false negatives (a threat which is not caught) doesn't cause nearly the pucker as a false positive (something which is not a threat which is flagged as one). Their calculus and minimum may be driven by somewhat different objectives, because their audience is advertisers not security practitioners. You can still 1:1 addresses to purposes and if you see crosstalk you can draw conclusions. Their normalization is lossy; that's the point. The cynic in me notes that given the absolute lack of originality in password choice, similar lack of entropy could be seen in 1:1 mappings and perhaps they can infer that if you're hansolo@ and they're example.com, that the email address you'd use is han.solo+example@. The cynic also says: that's on you. But damn, I'm looking better all the time: https://github.com/m3047/trualias https://github.com/m3047/trualias

raincom 4y ago

Use these services: HideMyEmail on iOS masked emails on Fastmail Firefox relay DuckDuckGo email protection

wistlo 4y ago

What about owning a domain and using a unique address for each commercial entity? FOr example, amazon@mydomain.us, nytimes@mydomain.us, citibank@mydomain.us, etc. I have done this for years, but now gmail recipients are rejecting my email as spam. (I've gone through multiple iterations with the DNS configuration at the host, but fundamentally the IP address is tainted other customers on this provider using it to send spam. I shouldn't have to fork up for a dedicated whitelisted IP address just to get functional email). As a result now I have a dedicated @gmail.com address just for those folks and businesses. I'm surprised the world, and most especially the tech community, embraced gmail so quickly. Yes, it's a great interface, yes, it's free, but from the start they said they would be scanning content and collecting infomation from email content. WHy are we OK with that?

curiousgal 4y ago
The downside is when I have to reach out to customer support re my account. I can only send emails from my main address.
- propogandist 4y ago
  Fastmail supports the ability to send outbound mail from the email address the mail was sent to that may be of interest to you.
- Tepix 4y ago
  With Thunderbird you can edit your email address before sending. It used to be even more comfortable using the "virtual identity" extension its author gave up maintaining it after Thunderbird 68 https://www.absorb.it/virtual-id/ https://www.absorb.it/virtual-id/
  - account42 4y ago
    Thunderbird can also automatically select the reply from address based on the original to address but afaict only for addresses you have configured and not for whole catch-all domainst - I guess that is something the extension allowed? Sometimes I wonder if Mozilla don't realize of what their extension API redesigns are costing the world or if their just don't care...

Animats 4y ago

Since I dropped my Google and Facebook accounts, and blocked all Google and Facebook tracking, I don't get spammed much. I'm not anonymous. I have patents, trademarks, D/B/A names, and domains with my real name and address. No spam. Maybe once a year, a paper letter. I'm on Github, Mastodon, and PeerTube. No spam. I still get some spam. It's totally mis-targeted. Currently in my spam folder: Ads for edible oil can filling equipment, and for ammonium sulfate nitrate fertilizer from China. I don't farm. Spammers just don't seem to bother with targets not tracked by Google and Facebook any more. It's an upside to the ad monopoly.

deleted 4y ago
[deleted]
tgtweak 4y ago
>or ammonium sulfate nitrate fertilizer from China. I don't farm. "Not on facebook or google... must be a farmer"

pixeldetracking 4y ago

Thanks for sharing this! From the IAB, I'm not surprised unfortunately Normalize emails is "best practice" for all the dirty "unique identifiers" players, see ID5 for example https://support.id5.io/portal/en/kb/articles/passing-partner-data-to-id5#Deriving_the_Partner_Data_pd_Value https://support.id5.io/portal/en/kb/articles/passing-partner...

1vuio0pswjnm7 4y ago

"Personally, I recommend installing the uBlock advert blocker on all devices which support it." NB. I am a casual use of uBlock. I have nothing against it. However like other alternatives it may have limitations that are worth considering. At the very least we have to consider devices and applications that do not support uBlock Matrix/Origin. With respect to those that do support it, a company making large profits from advertising that controls a particular application, like a web browser, or that controls a particular operating system, like a graphical mobile or desktop one that no user ever compiles themselves, can "remove support" for uBlock at any time. Options for setting a default gateway and setting DNS servers are arguably even more prevalent on devices than support for uBlock. Presumably companies making large profits from advertising could remove support for DNS settings and default gateways from the operating systems they control, however this seems much less likely.^1 Where no user-configurable firewall is available on the device, we can sometimes use DNS settings, i.e. wildcards, to point DNS traffic to a DNS server we control. We can configure the DNS server to block/allow certain DNS traffic. We can also use the DNS server to point all HTTP traffic to the proxy. The DNS server and the proxy can be running on the loopback of the device or they could be running on the gateway, where the gateway is another computer that we control. What is needed to disrupt this UID API from IAB. Is DNS enough. Do we need to filter URLs for certain JS files. Do we need to filter cookies. "All UID2 endpoints use the same base URL. Environment Cloud_Region Code_Base_URL Testing AWS US East (Ohio) us-east-2 https://operator-integ.uidapi.com https://operator-integ.uidapi.com Production AWS US East (Ohio) us-east-2 https://prod.uidapi.com https://prod.uidapi.com Production AWS Asia Pacific (Sydney) ap-southeast-2 https://au.prod.uidapi.com https://au.prod.uidapi.com Production AWS Asia Pacific (Tokyo) ap-northeast-1 https://jp.prod.uidapi.com https://jp.prod.uidapi.com Production AWS Asia Pacific (Singapore) ap-southeast-1 https://sg.prod.uidapi.com https://sg.prod.uidapi.com For example, https://operator-integ.uidapi.com/v2/token/generate https://operator-integ.uidapi.com/v2/token/generate" Source: https://github.com/IABTechLab/uid2docs/blob/main/api/v2/README.md https://github.com/IABTechLab/uid2docs/blob/main/api/v2/READ... In authoritative DNS, a wildcard entry such as *.uidapi.com 1 IN A 127.0.0.1 would send HTTP requests for these UID API endpoints to the loopback. This is is the same effect as using a hosts file like the StevenBlack one. Except some applications may ignore /etc/hosts. In dnscache, djb's recursive DNS server, creating a one line file like echo 127.0.0.1 > dnscache/root/servers/uidapi.com would send DNS lookups for these UID API endoints to the loopback. (NB. AFAIK, unbound does not by itself support wildcards.) What about uBlock. uBlock relies on certain lists maintained by various third parties. For example, https://raw.githubusercontent.com/StevenBlack/hosts/master/data/StevenBlack/hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/d... https://codeload.github.com/easylist/easylist/zip/refs/heads/master https://codeload.github.com/easylist/easylist/zip/refs/heads... https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-online.txt https://malware-filter.gitlab.io/malware-filter/urlhaus-filt... https://raw.githubusercontent.com/gorhill/uBlock/master/assets/assets.json https://raw.githubusercontent.com/gorhill/uBlock/master/asse... (lists contained therein) I perused some of these lists looking for the uidapi.com endpoints. It's possible I missed something but I only got one result: cdn.uidapi.com in the StevenBlack hosts file I think all the third party lists are great, however those require constant dillgence and there are so many now it is becoming confusing. Personally I find whitelists that I control are easier for me to manage. I also find that on Android, NetGuard is more useful than uBlock. They do different things. I find NetGuard is more versatile. The number of domains that I need to access is much smaller and grows at a slower rate than the number of domains on the internet that need to be "blocked". As is sometimes done in firewall rules, using DNS I "block" all domains by defult and add A records for the domains I actually need to access. 1. There are numerous open source operating system projects that could provide those traditional, basic features to any user who wanted them. As it happens, such companies have relied considerably on such non-commercial, open source projects to create their own commercial, advertising-friendly versions.

shortrounddev 4y ago

As someone who works for a DMP/DSP provider which implements UID2, Let me clarify 3 things 1. It is against IAB terms of service for partners to store a map of UIDs to PII (email and phone). Many clients do NOT want to share PII with DMPs, and so IAB also allows clients to submit SHA-2 hashed PII for identification. So if you are afraid of UID implementations selling your email, all I can say is that its against the terms of service to do so in conjunction with a UID 2. UID2 DSP Workflow implementations must provide an opt-out endpoint to them so that your UID won't be used in targeted advertising if you choose. This does not require them to purge your UID from their records or any info associated with it, but they must ignore that info in bid requests if you have requested to opt-out. 3. IAB is currently the main provider of UID2, but the system is designed so anyone can become a provider. IAB may not be the one handling your PII or UID. It is intended to be a decentralized system to solve the coming death of proprietary 3rd party tracker cookies. Philosophically, we the users must accept that the price of free content is advertisement. If we want to continue to receive content, we must consent to some level of tracking and targeted advertising, or we must become okay with paying a monthly subscription for internet content. Without targeted advertising and a decentralized RTB ecosystem, there is no open internet; Google and Facebook will dominate everything, and small sites will be unable to compete

account42 4y ago
> 3. IAB is currently the main provider of UID2, but the system is designed so anyone can become a provider. IAB may not be the one handling your PII or UID. It is intended to be a decentralized system to solve the coming death of proprietary 3rd party tracker cookies. And you realize that third party cookies are gong away because people don't want to be tracked across different organizations, right? That means working around that limitation is the IAB and those working with them being actively malicious. > Philosophically, we the users must accept that the price of free content is advertisement. Nope. > If we want to continue to receive content, we must consent to some level of tracking and targeted advertising, or we must become okay with paying a monthly subscription for internet content. Absolutely not. It is human nature to create and to share. People have always created and shared - long before parasites like the advertisement industry have inserted themselves into that process. This argument is even more ridiculous for the internet where content is primarily created by users which receive no or almost no revenue from the ads shown by the platforms hosting their work. > Without targeted advertising and a decentralized RTB ecosystem, there is no open internet; There was an open internet before targeted advertisement. > Google and Facebook will dominate everything, and small sites will be unable to compete Google and Facebook are advertising companies. They dominate because of advertising.

paledot 4y ago

I remember a time when websites like AltaVista and Lycos would have column after column of checkboxes in the user settings, requesting that you check which categories of ads interested you.