9 ms·

I love JMAP. It's what allowed me and my team (at 1Password) to easily add support for Masked Emails, where we randomly generate your email address in addition

I love JMAP. It's what allowed me and my team (at 1Password) to easily add support for Masked Emails, where we randomly generate your email address in addition to your password. Our own Madeline Hanley wrote about that experience, if you'd like to see what it's like to work with JMAP: https://blog.1password.com/making-masked-email-with-jmap/ https://blog.1password.com/making-masked-email-with-jmap/

ilyt 3y ago
How JMAP made that better ? Last time we did something like that new email address was just "add entry to a Dovecot database", fully protocol agnostic
- calvinmorrison 3y ago
  because the masked email API matches the rest of the JMAP API, so it's easy to extend and support. Also, 1Password isn't running Dovecot, Fastmail is. So they're asking a 3rd party is a fairly standards conformant way to go and create a new email alias
saberworks 3y ago
I use Fastmail and 1Password, and I do used the masked email functionality. There is a massive gap, though, that makes it very difficult to rely on masked email. When I sign up for a new account somewhere, I can choose to create a masked email. If I later need to email that company (not reply via an existing email message), I must first somehow look up what email I used for that company, go into fastmail settings and create a "sender identity", remember the email address again, and then when I compose, remember to choose the sender identity that is associated with the masked email address I created for that specific company. If I forget or mess up any of those steps, I end up sending from my primary account or some other masked email address associated with some other company. Multiply that by dozens or even a hundred companies! It would be really nice if adding a masked email automatically created a "sending identity." Further, it would be nice if the masked email account had a nickname that included the domain I was on when I created the account. That way if I need to send an email to support@nike.com, I can use the filter and type "nike.com" and get the correct masked email address.
- joshring 3y ago
  This was also an issue I had, but there is actually very good support for this hidden by an invisible feature. Simply add an `*@domain` as your email address identity. When you select that as your from address the fastmail UI gives you an input box to use whatever email you want, you don't need to make a new identity each time. For lookup, I just use my password manager.
- SparkyMcUnicorn 3y ago
  > It would be really nice if adding a masked email automatically created a "sending identity." It does. Just click "... Show all" when choosing a sender, and that will expand the list/search to include masked emails. It should also show you the domain/service it was set up for. And as you noted, the masked email will automatically be used as the sender when replying to an email that was sent to it as well. Using 1Password makes it super easy to see which masked email was used for each service, so I can't really relate to your frustrations there either. I think it's a pretty polished experience, and definitely beats everything else I've used in the past.
  - saberworks 3y ago
    > It does. Only sort of. First, this is a new feature, there used to be a whole section on adding "sending identities" and describing how to do it in order to send from a masked email address. I have support emails from 1Password pointing me to those docs as well. That whole section has been removed and now there's a note in the docs saying why (no date, though, so I don't know how recent). Second, your description glosses over the fact that if I click the "from" address dropdown, and then in the filter/search field, type the domain associated with the masked email address, nothing shows up except "Show All." Why wouldn't a filter/search find the address? I have to click "Show All" and then repeat the search. However, if I search/filter for any of the dozens of "sending identities" I created previously, the search/filter works correctly. So the UI is completely broken. When I search/filter something, and nothing shows up except a "Show All" button, that's the UI telling me that there were no matches. Oh, but now I learn that there are matches, they're just hidden under "Show All" (which should be renamed to "show matching masked email addresses" or something!?).
nemoniac 3y ago
Off the current topic but since you're promoting 1Password, I notice their cookie policy references EU legislation but chooses not to comply with it. Do you know if that's intentional?
- remram 3y ago
  Indeed that is very awkward: "European Union (“EU”) legislation requires all website operators to inform website visitors about their usage of cookies" Later: "first-party and third-party cookies are used on: 1password.com (...) Stating that you need consent and not asking for it is extremely weird.
  - Asooka 3y ago
    AFAIK, certain classes of cookies do not require consent. For example, login cookies.
  - speleding 3y ago
    The legislation requires you to ask consent for non-essential (ie. tracking) cookies. So unless they put a tracking cookie on their site the behaviour is correct, and that text is simply incorrect.
    - matteason 3y ago
      They do use nonessential cookies - Google Analytics, affiliate tracking cookies and more: https://1password.com/legal/cookies/#cookies-we-use-on-our-website https://1password.com/legal/cookies/#cookies-we-use-on-our-w...
    - remram 3y ago
      That's my bad for not quoting further, the very next paragraph is: > First-party cookies are set by 1Password. They help calculate things like page views and visitors to the website. Third-party cookies are set by 1Password affiliates for commission and advertising purposes. https://1password.com/legal/cookies/ https://1password.com/legal/cookies/ They make it clear that they know consent is required, that they absolutely fall into that category, and then don't ask.
Avamander 3y ago
Yet your 1password.eu DMARC is set to a very shameful p=none. Priorities...
kazinator 3y ago
I easily implemented throw-away mailing addresses over an IMAP/SMTP setup. https://www.kylheku.com/cgit/tamarind/ https://www.kylheku.com/cgit/tamarind/ This is a CGI-scripted web application without any kind of web framework, in an original programming language. It authenticates you using IMAP or SASL: with direct socket work in a few lines of code. (That's the only integration with IMAP.) It manages aliases in a standard aliases file. If configured, it can work with the master /etc/aliases file, in which cases it will carve out a section of the file for itself and respect the surrounding file when it adds or removes aliases. I run a separate aliases file, though.
- kazinator 3y ago
  I do most of my mailing using the RoundCube webmail interface. I made some patches to it. In connection with the throw-away mail aliases, the issue that comes up is that when you use them for sending, rather than just receiving mails, you want that to be available in the list of sender identities in the mail client. While it isn't automatic, I put in a hack which at least makes it easier to identify the mail identities. In RoundCube, a mail identity has an "Organization" field: what org you belong to. There is a mail header for that, IIRC. I changed the UI so that when you look at the identities list box, the Organization field is listed in parentheses (if it is non-blank). Then I use Organization to describe the purpose of the mail alias, e.g "Foo Mailing List" or "ABC Company". Only a small subset of my throw-away mail aliases become sender identities; I do that manually.
- nilespotter 3y ago
  I use catch all aliasing and sieve out the offenders. Seems easier.
  - kazinator 3y ago
    Yes; this is for the control freak that wants to shut down the offenders at the SMTP level. Plus there are some other benefits. Each one is associated with note field. URLs in the note field are rendered navigable. I use the note fields not only as a reminder about what the alias is for but also for PW management. Throwaway mail aliases often have throwaway passwords associated with them too. The explicitly created aliases track their creation date, which can be informative from time to time. UI has a regex search over the aliases (any field).

ilyt 3y ago

How JMAP made that better ? Last time we did something like that new email address was just "add entry to a Dovecot database", fully protocol agnostic

calvinmorrison 3y ago
because the masked email API matches the rest of the JMAP API, so it's easy to extend and support. Also, 1Password isn't running Dovecot, Fastmail is. So they're asking a 3rd party is a fairly standards conformant way to go and create a new email alias

saberworks 3y ago

I use Fastmail and 1Password, and I do used the masked email functionality. There is a massive gap, though, that makes it very difficult to rely on masked email. When I sign up for a new account somewhere, I can choose to create a masked email. If I later need to email that company (not reply via an existing email message), I must first somehow look up what email I used for that company, go into fastmail settings and create a "sender identity", remember the email address again, and then when I compose, remember to choose the sender identity that is associated with the masked email address I created for that specific company. If I forget or mess up any of those steps, I end up sending from my primary account or some other masked email address associated with some other company. Multiply that by dozens or even a hundred companies! It would be really nice if adding a masked email automatically created a "sending identity." Further, it would be nice if the masked email account had a nickname that included the domain I was on when I created the account. That way if I need to send an email to support@nike.com, I can use the filter and type "nike.com" and get the correct masked email address.

joshring 3y ago
This was also an issue I had, but there is actually very good support for this hidden by an invisible feature. Simply add an `*@domain` as your email address identity. When you select that as your from address the fastmail UI gives you an input box to use whatever email you want, you don't need to make a new identity each time. For lookup, I just use my password manager.
SparkyMcUnicorn 3y ago
> It would be really nice if adding a masked email automatically created a "sending identity." It does. Just click "... Show all" when choosing a sender, and that will expand the list/search to include masked emails. It should also show you the domain/service it was set up for. And as you noted, the masked email will automatically be used as the sender when replying to an email that was sent to it as well. Using 1Password makes it super easy to see which masked email was used for each service, so I can't really relate to your frustrations there either. I think it's a pretty polished experience, and definitely beats everything else I've used in the past.
- saberworks 3y ago
  > It does. Only sort of. First, this is a new feature, there used to be a whole section on adding "sending identities" and describing how to do it in order to send from a masked email address. I have support emails from 1Password pointing me to those docs as well. That whole section has been removed and now there's a note in the docs saying why (no date, though, so I don't know how recent). Second, your description glosses over the fact that if I click the "from" address dropdown, and then in the filter/search field, type the domain associated with the masked email address, nothing shows up except "Show All." Why wouldn't a filter/search find the address? I have to click "Show All" and then repeat the search. However, if I search/filter for any of the dozens of "sending identities" I created previously, the search/filter works correctly. So the UI is completely broken. When I search/filter something, and nothing shows up except a "Show All" button, that's the UI telling me that there were no matches. Oh, but now I learn that there are matches, they're just hidden under "Show All" (which should be renamed to "show matching masked email addresses" or something!?).

nemoniac 3y ago

Off the current topic but since you're promoting 1Password, I notice their cookie policy references EU legislation but chooses not to comply with it. Do you know if that's intentional?

remram 3y ago
Indeed that is very awkward: "European Union (“EU”) legislation requires all website operators to inform website visitors about their usage of cookies" Later: "first-party and third-party cookies are used on: 1password.com (...) Stating that you need consent and not asking for it is extremely weird.
- Asooka 3y ago
  AFAIK, certain classes of cookies do not require consent. For example, login cookies.
- speleding 3y ago
  The legislation requires you to ask consent for non-essential (ie. tracking) cookies. So unless they put a tracking cookie on their site the behaviour is correct, and that text is simply incorrect.
  - matteason 3y ago
    They do use nonessential cookies - Google Analytics, affiliate tracking cookies and more: https://1password.com/legal/cookies/#cookies-we-use-on-our-website https://1password.com/legal/cookies/#cookies-we-use-on-our-w...
  - remram 3y ago
    That's my bad for not quoting further, the very next paragraph is: > First-party cookies are set by 1Password. They help calculate things like page views and visitors to the website. Third-party cookies are set by 1Password affiliates for commission and advertising purposes. https://1password.com/legal/cookies/ https://1password.com/legal/cookies/ They make it clear that they know consent is required, that they absolutely fall into that category, and then don't ask.

Avamander 3y ago

Yet your 1password.eu DMARC is set to a very shameful p=none. Priorities...

kazinator 3y ago

I easily implemented throw-away mailing addresses over an IMAP/SMTP setup. https://www.kylheku.com/cgit/tamarind/ https://www.kylheku.com/cgit/tamarind/ This is a CGI-scripted web application without any kind of web framework, in an original programming language. It authenticates you using IMAP or SASL: with direct socket work in a few lines of code. (That's the only integration with IMAP.) It manages aliases in a standard aliases file. If configured, it can work with the master /etc/aliases file, in which cases it will carve out a section of the file for itself and respect the surrounding file when it adds or removes aliases. I run a separate aliases file, though.

kazinator 3y ago
I do most of my mailing using the RoundCube webmail interface. I made some patches to it. In connection with the throw-away mail aliases, the issue that comes up is that when you use them for sending, rather than just receiving mails, you want that to be available in the list of sender identities in the mail client. While it isn't automatic, I put in a hack which at least makes it easier to identify the mail identities. In RoundCube, a mail identity has an "Organization" field: what org you belong to. There is a mail header for that, IIRC. I changed the UI so that when you look at the identities list box, the Organization field is listed in parentheses (if it is non-blank). Then I use Organization to describe the purpose of the mail alias, e.g "Foo Mailing List" or "ABC Company". Only a small subset of my throw-away mail aliases become sender identities; I do that manually.
nilespotter 3y ago
I use catch all aliasing and sieve out the offenders. Seems easier.
- kazinator 3y ago
  Yes; this is for the control freak that wants to shut down the offenders at the SMTP level. Plus there are some other benefits. Each one is associated with note field. URLs in the note field are rendered navigable. I use the note fields not only as a reminder about what the alias is for but also for PW management. Throwaway mail aliases often have throwaway passwords associated with them too. The explicitly created aliases track their creation date, which can be informative from time to time. UI has a regex search over the aliases (any field).