10 ms·

> As part of the UID2 API they specifically describe how an advertiser must "normalise" their users' email addresses. > > This means h.a.n.solo+iab@gmail.com be

> As part of the UID2 API they specifically describe how an advertiser must "normalise" their users' email addresses. > > This means h.a.n.solo+iab@gmail.com becomes plain old hansolo@gmail.com It seemed to be completely obvious to me even decades back, that the + scheme would be trivially parsed and reversed. So I don't use it and just keep on making completely new aliases. So amazon gets amazon@example.com. If I'm not going to pay for anything on this account it also gets a random name from a random piece of well known media, like "Donald Duck", and all the data filled in randomly to ensure that it's not googleable, and doesn't correlate with any accounts anywhere else. The bigger issue I see is the desire to link everything to a phone number. Even stuff made for privacy, like Signal.

6510 4y ago
how big is the website? ignore everything before @
fluidcruft 4y ago
Careful, if you use that at amazon, it's also completely trivial for amazon to notice and package you up as "@example.com" and flag "@example.com" on a central watchlist so others do the same. Although a trick could be if you setup your service to run "service+username@example.com" then depending on how they implement their normalization, they'll chop off the username for you and track themselves.
- dale_glass 4y ago
  True, they could do that, but I highly doubt that it's a common enough practice for the industry to bother. And it still has the advantage that I can remove an alias and it's not obvious what the main account it leads to is.
- maeil 4y ago
  What are you suggesting they would use such a central watchlist for? It's not like they're going to deny service to those who have "amazon" in their email address. And what kind of centralization are you talking about? Sharing it with other companies? I'm as pessimistic about these things as they come but even to me that seems incredibly unlikely.
  - fluidcruft 4y ago
    The scheme they're designing is for selling ads. Every site using their scheme has a rule to clean gmail addresses (thIs.is.mY.email+extRastUFf@gmail.com) to be "thisismyemail@gmail.com" then they hash that clean form to obtain "UNIQUEID#123232". Then they use the hash to ask the ad network "who wants to pay the most to show an ad to UNIQUEID#123232?". All the sites you login to and ad networks they use will know this same id. If you do something obvious like use amazon@example.com at amazon, you should expect them to add a rule that blah_blah_anything@example.com gets cleaned up to "@example.com"
    - dale_glass 4y ago
      That can't be avoided short of having a mail service with plentiful full aliases on a shared domain. They could just use the heuristic that unless you're at one of the well known email providers like Gmail, your domain name might be personal and therefore count as part of your global identity, without even considering what comes before the @. So it doesn't really matter much whether I go with amazon@example.com, or john.random@example.com. To deal with that for good you'd need a pretty large set of domain names to use for this purpose.
      - fluidcruft 4y ago
        There are already a growing number of services that won't even allow you to sign up unless you have an email at one of the large services. I never noticed until I started using my personal domain to separate work/personal after changing jobs recently.
        catiopatio 4y ago
        What are some examples? I’ve been using my own domain since the late 90s, and I’ve never run into this.
        MandieD 4y ago
        When I tried signing up for the SNL app a few years ago with snlnbc@[mydomain.com], and then [randomnickname]@[mydomain.com], it failed, but then worked with a GMail address. Which is all kinds of ironic, because I'm old enough to remember when free emails like hotmail.com and gmail.com were rejected by a lot of sites!
- kps 4y ago
  If you control your own email, you can set a character other than ‘+’. (For postfix and dovecot, look up `recipient_delimiter`.)
  - nicolas_t 4y ago
    I setup a sequence of letters which makes it completely unobvious for anyone who doesn't know the sequence
    - hgsgm 4y ago
      If you own your own domain, it's trivial for them to notice that it's a vanity domain for a single user or small group. The only way to hide is to have thousands of friends with diverse interests using your domain.
      - paledot 4y ago
        Trivial to a human looking at the data set, but it's something the algorithm would have to be trained to recognize.
        account42 4y ago
        Not really - in practice the tracking system can have a list of email providers and treat every other domain as one user (especially ones with catch-all setups).
      - nicolas_t 4y ago
        I don't think it's trivial at all? I sign up with random first names and last names, my email address doesn't have the actual company name and I don't think there's that many people with vanity domains to justify adding code to track this use case.
  - wpietri 4y ago
    For historical reasons I use a dash. This works just fine 99+% of the time, but very rarely a site will not allow a dash in emails.
fabbari 4y ago
My solution to this is to always use '+' email addresses - IE: "fabs+hulu@domain.com" - and I filter out all e-mails that don't have the '+' suffix as the recipient. This way dropping the suffix drops those e-mails in my spam folder. Them normalizing the address makes my spam filter more efficient - and I would like to thank them for it.
- fluidcruft 4y ago
  It's not about sending email. They hash the normalized email and use the hash to track activity across websites and services to build user profiles for real-time ad bids.
  - AstralStorm 4y ago
    Fancy that, this requires an explicit opt in by GDPR.
    - Nextgrid 4y ago
      That hasn't stopped them before: https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-euros-over-consent-framework-gdpr-violations/ https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-eu... And of course with such a small fine it's basically guaranteed they will continue breaching it since it makes them way more money.
    - Cthulhu_ 4y ago
      In theory yes; in practice, they'll track you anyway because it's not a crime unless you're found out, sued, and don't survive the lawsuit. I'm sure there's a lot of "underground" data transactions happening where the source of data is obfuscated.
      - tgsovlerkhgsel 4y ago
        Facebook (of all places!) is one of the few companies that makes this transparent. If you have a Facebook account, and live in GDPR-land, go check which companies illegally passed on your data (https://www.facebook.com/adpreferences/ad_settings https://www.facebook.com/adpreferences/ad_settings -> Audience based advertising) and report them!
jrochkind1 4y ago
Isn't it up to the email provider whether `+` and `.` are ignored in email addresses, won't removing them to "normalize" end up sometimes mapping different email addresses to the same identifier? I guess maybe that edge case is not nearly as bad for the advertisers as failing to link the same person, so it's tolerable?
- oops 4y ago
  Afaik the period thing is a Gmail thing while the plus thing is in the RFC. However it appears the IAB UID2 README says to only normalize pluses/periods for gmail.com addresses: https://github.com/IABTechLab/uid2docs/blob/main/api/README.md#email-address-normalization https://github.com/IABTechLab/uid2docs/blob/main/api/README....
  - brewmarche 4y ago
    There is an RFC but it just mentions + as an example of a possible sub-address separator when discussing sub-addresses in Sieve filters. Whether or not + acts as a sub-address separator is server-dependent.
  - jrochkind1 4y ago
    Oh good find, of course they can make a special rule for gmail, which is such a large portion of email addresses it's worth it.
- mananaysiempre 4y ago
  It’s even up to the email provider to make the local part completely or partially case-sensitive if they wish, but tell that to most government websites in the world. Probably a lost case at this point. Periods are more of a Gmail-specific thing, but as you mention merging two people once in a blue moon is not a terrible price to pay for an analytics system, it’s not like it’s going to send mail to these addresses.
- tlavoie 4y ago
  On my own host, a '_' was easily configured. Maybe these companies will normalize everything, but it works for me.
m4tthumphrey 4y ago
This. Have been doing this for years as whilst it's been very handy to prevent password leakage etc, it's also very interesting to see where my spam comes from; facebook@ is the biggest culprit.
- paledot 4y ago
  LinkedIn, too. I get a bunch of recruiter spam addressed to my old LinkedIn email that was probably compromised in the big hack/scraping incident from a few years back. Good way to flag the sketchiest recruiters.
superkuh 4y ago
>The bigger issue I see is the desire to link everything to a phone number. Yep, I've had my youtube account since before Google bought youtube in 2006. Just this week I noticed that I am no longer able to put URLs in the descriptions of videos I upload to youtube. I have to "verify" by giving them my phone number before any clickable URLs are allowed in descriptions. But apparently all URLs are clickable URLs. Additionally, even videos I uploaded in 2008, if I go to edit their descriptions now and I originally included a URL, I cannot submit it. Phone number "verification" is nasty. I suppose this is the end of my almost 2 decades of using youtube to host videos. As for email spam prevention, I've run my own mailserver with a domain since 2011. I give each service an actual unique email address and then just catch-all emails sent to my domain. It works great.
- account42 4y ago
  > I suppose this is the end of my almost 2 decades of using youtube to host videos. As a user I can only hope that more people do stop using YouTube, preferrably choosing something that serves video files directly instead. > As for email spam prevention, I've run my own mailserver with a domain since 2011. I give each service an actual unique email address and then just catch-all emails sent to my domain. It works great. This works but only because running your own mail server is too uncommon for anyone to care about. If it was more common, the advertisers or other privacy violators would specifically check for catch-all domains and then strip the entire local part of the email for your user id.
- Cthulhu_ 4y ago
  I think youtube's hegemony is past; it WAS the main point to upload your videos at some point because storage and bandwidth was expensive, and on-demand video conversion difficult and resource-intensive. But nowadays anyone can host videos on a $5/month shared server, with software to handle things like video conversion. Youtube pivoted from "just" hosting videos to a community though, to the point where you won't get any views unless you are on youtube and play by their rules and network effects.
  - dreen 4y ago
mtillman 4y ago
Re: phone numbers, the blocking of google voice style numbers is pretty dirty. Even openai requires a number that supports advertising in order to sign up for ChatGPT.
ChrisMarshallNY 4y ago
I've used spamex[0], for a couple of decades, I think. [0] https://www.spamex.com https://www.spamex.com
1letterunixname 4y ago
I don't use Signal for this reason. The fork Session does away with it, albeit they're backed by a crypto startup.
jnwatson 4y ago
I’ve used <targetdomain>@<mydomain> for 2 decades now. It eliminates the risk of password leaks and let’s me know who gives away my email addresses. That it also prevents ad tracking is even better.
c7b 4y ago
> just keep on making completely new aliases The problem with most of those tricks is that they can be countered in some way, so I feel this is one of the areas where your security has to rely to some extent on obscurity (or the fact that it's too rare in the wild to be worth countering). But I do have a question, have you found a programmatic way to create aliases / a provider that offers an API for that? Because that seems like one of the main usability downsides to your approach.
alasdair_ 4y ago
Even if I need to use my real address, I’ll use the “address 2” field to say something like “Amazon sold my information” I’ve had quite a lot of third party junk mail with this kind of stuff on it over the years.
- sedawk 4y ago
  Why am learning this only now! Brilliant, thanks for sharing.
- ChuckMcM 4y ago
  I like this! I will do this in the future.
- gjsman-1000 4y ago
  That, my friend, is a brilliant trick. Genius award of the day.
- Eleison23 4y ago
  [dead]
- jay-barronville 4y ago
  That’s kind of funny and clever at the same time. Well done. I’m going to try this.
- Tepix 4y ago
  You can also use 26 different middle initials.
Vinnl 4y ago
That's why for Firefox Relay [1], we recommend using random email masks, and why I use it over my own catch-all domain for unimportant things. We do support your own catch-all subdomain, but that is just to cover the use case of having to come up with an email mask on-the-spot. If you are filling in a web form, best to use an email address that looks exactly like the email addresses of other Relay users. [1] https://relay.firefox.com/ https://relay.firefox.com/
- wardedVibe 4y ago
  This seems handy, particularly the phone number part. Reminds me of the privacy credit card system, though their backend is privacy compromised.
  - Vinnl 4y ago
    Yep, credit cards are definitely of interest to us too, but unfortunately we haven't been able to find a way to do so in a privacy-friendly manner yet, which is the entire point.
rendaw 4y ago
I do the alias thing, but I've been getting spam email lately that simply doesn't have my email anywhere within it, and I'm not sure how to deal with it. Honestly I'd expect it to be dropped at somewhere in the pipeline, but I can't find an option to deal with it in Thunderbird at the least.
- rstuart4133 4y ago
  The raw email received almost certainly does have your email in it. Your problem is your client isn't displaying it to you. In fact email has a lot of redundant information in it to administrators debug problems, and just about all of it won't be displayed by your typical email client as it would be confusing to most people. Some clients will display the "raw, as received" email if you ask them too. GMail has a "Show Original" menu item for example. In there, you will find "Received: ... for <XXXXXX@gmail.com>". The exact form does vary between systems, but it's almost always there.
  - rendaw 4y ago
    No, I checked the source and my email didn't appear anywhere.
    - account42 4y ago
      Its up to the receiving mail server to add the RCPT TO and other enveleope information to the delivered mail.
    - rendaw 4y ago
      Well, I can't find the email now and none of the other spam I checked did that. I swear I triple checked, but maybe it was just my imagination.
tenebrisalietum 4y ago
VoIP numbers are cheap.
andrepd 4y ago
>The bigger issue I see is the desire to link everything to a phone number. Even stuff made for privacy, like Signal I have a throwaway SIM for that
tlavoie 4y ago
Also, the character that might be used to delineate aliases can be defined, at least if you have control of the email host. Some hosts will complain about their name as part of the email address, but usually some near-match will suffice.
Tepix 4y ago
> It seemed to be completely obvious to me even decades back, that the + scheme would be trivially parsed and reversed. I was expecting to see that, too but in more than 15 years of running my own mailserver i don't think i have had an attacker that has removed the suffix when trying to phish me. These attacks are automated. Your address is just one of many that is being harvested and sold to someone else who conducts the phishing campaign.

6510 4y ago

how big is the website? ignore everything before @

fluidcruft 4y ago

Careful, if you use that at amazon, it's also completely trivial for amazon to notice and package you up as "@example.com" and flag "@example.com" on a central watchlist so others do the same. Although a trick could be if you setup your service to run "service+username@example.com" then depending on how they implement their normalization, they'll chop off the username for you and track themselves.

dale_glass 4y ago
True, they could do that, but I highly doubt that it's a common enough practice for the industry to bother. And it still has the advantage that I can remove an alias and it's not obvious what the main account it leads to is.
maeil 4y ago
What are you suggesting they would use such a central watchlist for? It's not like they're going to deny service to those who have "amazon" in their email address. And what kind of centralization are you talking about? Sharing it with other companies? I'm as pessimistic about these things as they come but even to me that seems incredibly unlikely.
- fluidcruft 4y ago
  The scheme they're designing is for selling ads. Every site using their scheme has a rule to clean gmail addresses (thIs.is.mY.email+extRastUFf@gmail.com) to be "thisismyemail@gmail.com" then they hash that clean form to obtain "UNIQUEID#123232". Then they use the hash to ask the ad network "who wants to pay the most to show an ad to UNIQUEID#123232?". All the sites you login to and ad networks they use will know this same id. If you do something obvious like use amazon@example.com at amazon, you should expect them to add a rule that blah_blah_anything@example.com gets cleaned up to "@example.com"
  - dale_glass 4y ago
    That can't be avoided short of having a mail service with plentiful full aliases on a shared domain. They could just use the heuristic that unless you're at one of the well known email providers like Gmail, your domain name might be personal and therefore count as part of your global identity, without even considering what comes before the @. So it doesn't really matter much whether I go with amazon@example.com, or john.random@example.com. To deal with that for good you'd need a pretty large set of domain names to use for this purpose.
    - fluidcruft 4y ago
      There are already a growing number of services that won't even allow you to sign up unless you have an email at one of the large services. I never noticed until I started using my personal domain to separate work/personal after changing jobs recently.
      - catiopatio 4y ago
        What are some examples? I’ve been using my own domain since the late 90s, and I’ve never run into this.
        MandieD 4y ago
        When I tried signing up for the SNL app a few years ago with snlnbc@[mydomain.com], and then [randomnickname]@[mydomain.com], it failed, but then worked with a GMail address. Which is all kinds of ironic, because I'm old enough to remember when free emails like hotmail.com and gmail.com were rejected by a lot of sites!
kps 4y ago
If you control your own email, you can set a character other than ‘+’. (For postfix and dovecot, look up `recipient_delimiter`.)
- nicolas_t 4y ago
  I setup a sequence of letters which makes it completely unobvious for anyone who doesn't know the sequence
  - hgsgm 4y ago
    If you own your own domain, it's trivial for them to notice that it's a vanity domain for a single user or small group. The only way to hide is to have thousands of friends with diverse interests using your domain.
    - paledot 4y ago
      Trivial to a human looking at the data set, but it's something the algorithm would have to be trained to recognize.
      - account42 4y ago
        Not really - in practice the tracking system can have a list of email providers and treat every other domain as one user (especially ones with catch-all setups).
    - nicolas_t 4y ago
      I don't think it's trivial at all? I sign up with random first names and last names, my email address doesn't have the actual company name and I don't think there's that many people with vanity domains to justify adding code to track this use case.
- wpietri 4y ago
  For historical reasons I use a dash. This works just fine 99+% of the time, but very rarely a site will not allow a dash in emails.

fabbari 4y ago

My solution to this is to always use '+' email addresses - IE: "fabs+hulu@domain.com" - and I filter out all e-mails that don't have the '+' suffix as the recipient. This way dropping the suffix drops those e-mails in my spam folder. Them normalizing the address makes my spam filter more efficient - and I would like to thank them for it.

fluidcruft 4y ago
It's not about sending email. They hash the normalized email and use the hash to track activity across websites and services to build user profiles for real-time ad bids.
- AstralStorm 4y ago
  Fancy that, this requires an explicit opt in by GDPR.
  - Nextgrid 4y ago
    That hasn't stopped them before: https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-euros-over-consent-framework-gdpr-violations/ https://iapp.org/news/a/belgian-dpa-fines-iab-europe-250k-eu... And of course with such a small fine it's basically guaranteed they will continue breaching it since it makes them way more money.
  - Cthulhu_ 4y ago
    In theory yes; in practice, they'll track you anyway because it's not a crime unless you're found out, sued, and don't survive the lawsuit. I'm sure there's a lot of "underground" data transactions happening where the source of data is obfuscated.
    - tgsovlerkhgsel 4y ago
      Facebook (of all places!) is one of the few companies that makes this transparent. If you have a Facebook account, and live in GDPR-land, go check which companies illegally passed on your data (https://www.facebook.com/adpreferences/ad_settings https://www.facebook.com/adpreferences/ad_settings -> Audience based advertising) and report them!

jrochkind1 4y ago

Isn't it up to the email provider whether `+` and `.` are ignored in email addresses, won't removing them to "normalize" end up sometimes mapping different email addresses to the same identifier? I guess maybe that edge case is not nearly as bad for the advertisers as failing to link the same person, so it's tolerable?

oops 4y ago
Afaik the period thing is a Gmail thing while the plus thing is in the RFC. However it appears the IAB UID2 README says to only normalize pluses/periods for gmail.com addresses: https://github.com/IABTechLab/uid2docs/blob/main/api/README.md#email-address-normalization https://github.com/IABTechLab/uid2docs/blob/main/api/README....
- brewmarche 4y ago
  There is an RFC but it just mentions + as an example of a possible sub-address separator when discussing sub-addresses in Sieve filters. Whether or not + acts as a sub-address separator is server-dependent.
- jrochkind1 4y ago
  Oh good find, of course they can make a special rule for gmail, which is such a large portion of email addresses it's worth it.
mananaysiempre 4y ago
It’s even up to the email provider to make the local part completely or partially case-sensitive if they wish, but tell that to most government websites in the world. Probably a lost case at this point. Periods are more of a Gmail-specific thing, but as you mention merging two people once in a blue moon is not a terrible price to pay for an analytics system, it’s not like it’s going to send mail to these addresses.
tlavoie 4y ago
On my own host, a '_' was easily configured. Maybe these companies will normalize everything, but it works for me.

m4tthumphrey 4y ago

This. Have been doing this for years as whilst it's been very handy to prevent password leakage etc, it's also very interesting to see where my spam comes from; facebook@ is the biggest culprit.

paledot 4y ago
LinkedIn, too. I get a bunch of recruiter spam addressed to my old LinkedIn email that was probably compromised in the big hack/scraping incident from a few years back. Good way to flag the sketchiest recruiters.

superkuh 4y ago

>The bigger issue I see is the desire to link everything to a phone number. Yep, I've had my youtube account since before Google bought youtube in 2006. Just this week I noticed that I am no longer able to put URLs in the descriptions of videos I upload to youtube. I have to "verify" by giving them my phone number before any clickable URLs are allowed in descriptions. But apparently all URLs are clickable URLs. Additionally, even videos I uploaded in 2008, if I go to edit their descriptions now and I originally included a URL, I cannot submit it. Phone number "verification" is nasty. I suppose this is the end of my almost 2 decades of using youtube to host videos. As for email spam prevention, I've run my own mailserver with a domain since 2011. I give each service an actual unique email address and then just catch-all emails sent to my domain. It works great.

account42 4y ago
> I suppose this is the end of my almost 2 decades of using youtube to host videos. As a user I can only hope that more people do stop using YouTube, preferrably choosing something that serves video files directly instead. > As for email spam prevention, I've run my own mailserver with a domain since 2011. I give each service an actual unique email address and then just catch-all emails sent to my domain. It works great. This works but only because running your own mail server is too uncommon for anyone to care about. If it was more common, the advertisers or other privacy violators would specifically check for catch-all domains and then strip the entire local part of the email for your user id.
Cthulhu_ 4y ago
I think youtube's hegemony is past; it WAS the main point to upload your videos at some point because storage and bandwidth was expensive, and on-demand video conversion difficult and resource-intensive. But nowadays anyone can host videos on a $5/month shared server, with software to handle things like video conversion. Youtube pivoted from "just" hosting videos to a community though, to the point where you won't get any views unless you are on youtube and play by their rules and network effects.
- dreen 4y ago

mtillman 4y ago

Re: phone numbers, the blocking of google voice style numbers is pretty dirty. Even openai requires a number that supports advertising in order to sign up for ChatGPT.

ChrisMarshallNY 4y ago

I've used spamex[0], for a couple of decades, I think. [0] https://www.spamex.com https://www.spamex.com

1letterunixname 4y ago

I don't use Signal for this reason. The fork Session does away with it, albeit they're backed by a crypto startup.

jnwatson 4y ago

I’ve used <targetdomain>@<mydomain> for 2 decades now. It eliminates the risk of password leaks and let’s me know who gives away my email addresses. That it also prevents ad tracking is even better.

c7b 4y ago

> just keep on making completely new aliases The problem with most of those tricks is that they can be countered in some way, so I feel this is one of the areas where your security has to rely to some extent on obscurity (or the fact that it's too rare in the wild to be worth countering). But I do have a question, have you found a programmatic way to create aliases / a provider that offers an API for that? Because that seems like one of the main usability downsides to your approach.

alasdair_ 4y ago

Even if I need to use my real address, I’ll use the “address 2” field to say something like “Amazon sold my information” I’ve had quite a lot of third party junk mail with this kind of stuff on it over the years.

sedawk 4y ago
Why am learning this only now! Brilliant, thanks for sharing.
ChuckMcM 4y ago
I like this! I will do this in the future.
gjsman-1000 4y ago
That, my friend, is a brilliant trick. Genius award of the day.
Eleison23 4y ago
[dead]
jay-barronville 4y ago
That’s kind of funny and clever at the same time. Well done. I’m going to try this.
Tepix 4y ago
You can also use 26 different middle initials.

Vinnl 4y ago

That's why for Firefox Relay [1], we recommend using random email masks, and why I use it over my own catch-all domain for unimportant things. We do support your own catch-all subdomain, but that is just to cover the use case of having to come up with an email mask on-the-spot. If you are filling in a web form, best to use an email address that looks exactly like the email addresses of other Relay users. [1] https://relay.firefox.com/ https://relay.firefox.com/

wardedVibe 4y ago
This seems handy, particularly the phone number part. Reminds me of the privacy credit card system, though their backend is privacy compromised.
- Vinnl 4y ago
  Yep, credit cards are definitely of interest to us too, but unfortunately we haven't been able to find a way to do so in a privacy-friendly manner yet, which is the entire point.

rendaw 4y ago

I do the alias thing, but I've been getting spam email lately that simply doesn't have my email anywhere within it, and I'm not sure how to deal with it. Honestly I'd expect it to be dropped at somewhere in the pipeline, but I can't find an option to deal with it in Thunderbird at the least.

rstuart4133 4y ago
The raw email received almost certainly does have your email in it. Your problem is your client isn't displaying it to you. In fact email has a lot of redundant information in it to administrators debug problems, and just about all of it won't be displayed by your typical email client as it would be confusing to most people. Some clients will display the "raw, as received" email if you ask them too. GMail has a "Show Original" menu item for example. In there, you will find "Received: ... for <XXXXXX@gmail.com>". The exact form does vary between systems, but it's almost always there.
- rendaw 4y ago
  No, I checked the source and my email didn't appear anywhere.
  - account42 4y ago
    Its up to the receiving mail server to add the RCPT TO and other enveleope information to the delivered mail.
  - rendaw 4y ago
    Well, I can't find the email now and none of the other spam I checked did that. I swear I triple checked, but maybe it was just my imagination.

tenebrisalietum 4y ago

VoIP numbers are cheap.

andrepd 4y ago

>The bigger issue I see is the desire to link everything to a phone number. Even stuff made for privacy, like Signal I have a throwaway SIM for that

tlavoie 4y ago

Also, the character that might be used to delineate aliases can be defined, at least if you have control of the email host. Some hosts will complain about their name as part of the email address, but usually some near-match will suffice.

Tepix 4y ago

> It seemed to be completely obvious to me even decades back, that the + scheme would be trivially parsed and reversed. I was expecting to see that, too but in more than 15 years of running my own mailserver i don't think i have had an attacker that has removed the suffix when trying to phish me. These attacks are automated. Your address is just one of many that is being harvested and sold to someone else who conducts the phishing campaign.