4 ms·

I do this with my email. I have a bunch of different emails under my own domain, and I use info+uniqueidentifier@domain.org for registrations which do not warra

by sspiff 3y ago

I do this with my email. I have a bunch of different emails under my own domain, and I use info+uniqueidentifier@domain.org for registrations which do not warrant their own actual email handle. This way, I can easily filter incoming email, and I can see where an email came from if any party sells my data. This also works with GMail by the way, you can use youraccount+anyrandomstring@gmail.com and emails will still be delivered to you. I use a separate email handle that I only hand out to actual human beings, never to companies and never use for account registrations. This has worked really well for the past 15 years or so.

wahnfrieden 3y ago
Apple has this as a service now. It's more automatic than the GMail process and works well. A weakness with the GMail process is that spammers are able to remove the + part (even if most don't), and your credentials or identity can be aligned across leaked credential databases by removing the + part.
- sspiff 3y ago
  They can, but in my case that still doesn't get them in my inbox since those messages go elsewhere.
jkaptur 3y ago
It seems like this approach is really popular. Have no spammers/data brokers caught on and started stripping the +identifier?
- aqfamnzc 3y ago
  If they were really smart, they'd parse and use that info to their advantage. Have info+autozone@domain.com? Send company-specific phishing emails to +apple, +wellsfargo, +$POPULAR_COMPANY every other week
- myself248 3y ago
  Can't you just reject email that comes in to the base address without the identifier?
jowea 3y ago
I heard about the +, but don't some sites reject it? Or can't bad actors just strip it? You'd need your own domain with a large amount of unique identifiers for it to work if it became popular.
- heleninboodler 3y ago
  I find it quite rare for systems to reject the + these days. One notable exception is my credit union, whose Web 1.0 system turned it into a space. The most annoying thing about this practice is if you're telling it to a human, they are very confused about your email address having their company's name in it. I occasionally get "do you work here or something?" Every once in a while I'm talking to someone (example: elementary school secretary) who gives me a vibe that they're going to be really thrown off by this and I just make up a three letter unique code for a suffix since I can still search for whoever sent me that first to see what the suffix means. On the stripping of the + and suffix, yeah, bad actors who recognize your scheme can do that, but spamming is about quantity, not quality, so they just aren't going to put in the effort.
  - nunez 3y ago
    unfortunately, i disagree; i stopped using plus sign addressing because so many sites i wanted to use it on (many of them for important things like medical stuff) wouldn't accept it
  - jowea 3y ago
    Spamming is about quantity but stripping a "+" is something a one line script can do, which is what will happen if this gets popular. A real solution should be more resilient. Like spam binning anything that does not use the "+" ?
    - heleninboodler 3y ago
      Well, I've always thought it would be fairly easy to strip, but I've now been doing it for 25 years and it's obvious the spammers aren't going to go to even that small effort. I once heard the CEO of wordpress say that it would be easy for them to go after adblockers too, but they explicitly didn't because the userbase that went to the trouble of installing adblockers didn't tend to be a lucrative advertising demographic anyway. It's all about return on your investment.
ninkendo 3y ago
iCloud’s Hide My Email is perfect for this. No “+” convention, it just generates a random @icloud.com email address specifically for whatever website/app you’re signing up for, and forwards it to your real email. The random addresses are indistinguishable from real iCloud.com email addresses, there’s no naming convention a website can reject. I never worry about sites that require signups any more, I just autogenerate an email for them and use a fake name. I couldn’t give a shit less if they get hacked or leak data, because the email and password are randomly generated. If they turn out to spam me I just disable that email address and never hear from them again. The only people who have my “real” email addresses are people I know personally.
- FireBeyond 3y ago
  > The random addresses are indistinguishable from real iCloud.com email addresses, there’s no naming convention a website can reject. That's not remotely true. The very very very vast majority of actual iCloud email addresses are going to have "dictionary" names. It's quite trivial to detect a randomized address (and at that point, you probably don't even care about a couple of false positives). Multiple instances of letter-number-letter-number ("b2y4r")? Coupled with letter combinations that don't exist in most languages ("ytbn")? And no dictionary words ("john", "smith", "booklover")? Random address. Now, whether you care to do business with someone who detects this is a different question altogether. But they are absolutely distinguishable.
  - ninkendo 3y ago
    The auto-generated addresses also have dictionary names. They’re explicitly designed to look like addresses that a real person might come up with… typically a dictionary word, followed by some numbers and symbols. Just like other email addresses on popular services where all the good names are taken.
    - FireBeyond 3y ago
      The ones I've seen are like a987dfc429be@icloud.com. Same with Private Relay: here's one of mine (with one character changed) - 2he5rs923s@privaterelay.appleid.com

by sspiff 3y ago

wahnfrieden 3y ago

Apple has this as a service now. It's more automatic than the GMail process and works well. A weakness with the GMail process is that spammers are able to remove the + part (even if most don't), and your credentials or identity can be aligned across leaked credential databases by removing the + part.

sspiff 3y ago
They can, but in my case that still doesn't get them in my inbox since those messages go elsewhere.

jkaptur 3y ago

It seems like this approach is really popular. Have no spammers/data brokers caught on and started stripping the +identifier?

aqfamnzc 3y ago
If they were really smart, they'd parse and use that info to their advantage. Have info+autozone@domain.com? Send company-specific phishing emails to +apple, +wellsfargo, +$POPULAR_COMPANY every other week
myself248 3y ago
Can't you just reject email that comes in to the base address without the identifier?

jowea 3y ago

I heard about the +, but don't some sites reject it? Or can't bad actors just strip it? You'd need your own domain with a large amount of unique identifiers for it to work if it became popular.

heleninboodler 3y ago
I find it quite rare for systems to reject the + these days. One notable exception is my credit union, whose Web 1.0 system turned it into a space. The most annoying thing about this practice is if you're telling it to a human, they are very confused about your email address having their company's name in it. I occasionally get "do you work here or something?" Every once in a while I'm talking to someone (example: elementary school secretary) who gives me a vibe that they're going to be really thrown off by this and I just make up a three letter unique code for a suffix since I can still search for whoever sent me that first to see what the suffix means. On the stripping of the + and suffix, yeah, bad actors who recognize your scheme can do that, but spamming is about quantity, not quality, so they just aren't going to put in the effort.
- nunez 3y ago
  unfortunately, i disagree; i stopped using plus sign addressing because so many sites i wanted to use it on (many of them for important things like medical stuff) wouldn't accept it
- jowea 3y ago
  Spamming is about quantity but stripping a "+" is something a one line script can do, which is what will happen if this gets popular. A real solution should be more resilient. Like spam binning anything that does not use the "+" ?
  - heleninboodler 3y ago
    Well, I've always thought it would be fairly easy to strip, but I've now been doing it for 25 years and it's obvious the spammers aren't going to go to even that small effort. I once heard the CEO of wordpress say that it would be easy for them to go after adblockers too, but they explicitly didn't because the userbase that went to the trouble of installing adblockers didn't tend to be a lucrative advertising demographic anyway. It's all about return on your investment.

ninkendo 3y ago

iCloud’s Hide My Email is perfect for this. No “+” convention, it just generates a random @icloud.com email address specifically for whatever website/app you’re signing up for, and forwards it to your real email. The random addresses are indistinguishable from real iCloud.com email addresses, there’s no naming convention a website can reject. I never worry about sites that require signups any more, I just autogenerate an email for them and use a fake name. I couldn’t give a shit less if they get hacked or leak data, because the email and password are randomly generated. If they turn out to spam me I just disable that email address and never hear from them again. The only people who have my “real” email addresses are people I know personally.

FireBeyond 3y ago
> The random addresses are indistinguishable from real iCloud.com email addresses, there’s no naming convention a website can reject. That's not remotely true. The very very very vast majority of actual iCloud email addresses are going to have "dictionary" names. It's quite trivial to detect a randomized address (and at that point, you probably don't even care about a couple of false positives). Multiple instances of letter-number-letter-number ("b2y4r")? Coupled with letter combinations that don't exist in most languages ("ytbn")? And no dictionary words ("john", "smith", "booklover")? Random address. Now, whether you care to do business with someone who detects this is a different question altogether. But they are absolutely distinguishable.
- ninkendo 3y ago
  The auto-generated addresses also have dictionary names. They’re explicitly designed to look like addresses that a real person might come up with… typically a dictionary word, followed by some numbers and symbols. Just like other email addresses on popular services where all the good names are taken.
  - FireBeyond 3y ago
    The ones I've seen are like a987dfc429be@icloud.com. Same with Private Relay: here's one of mine (with one character changed) - 2he5rs923s@privaterelay.appleid.com