6 ms·

Everyone Wants Your Email Address. Think Twice Before Sharing It

38 points by cebert 3y ago

cebert 3y ago
Listening to Security Now Episode 961 (https://twit.tv/shows/security-now/episodes/961 https://twit.tv/shows/security-now/episodes/961) highlighted a trend where sites like FoxNews.com require email sharing and agreeing to terms of service before content can be viewed. Delving into Fox News' Privacy Policy, it's clear the extent of data collection and sharing is vast, including personal and activity data, with provisions for third-party sharing for advertising. Such practices raise serious privacy concerns, especially given the extensive user profiling and data monetization involved. This approach could set a worrying precedent for content access, prioritizing data collection over user privacy (https://www.foxnews.com/privacy-policy#fi https://www.foxnews.com/privacy-policy#fi). I don't care about Fox News specifically, but I hope this trend requiring sharing an email address to view ad-supported content doesn't become more popular. An example of this on Fox News is this article, which requires an email address to view: https://www.foxnews.com/world/navalnys-body-reportedly-found-signs-bruising-russia-claims-he-died-sudden-death-syndrome https://www.foxnews.com/world/navalnys-body-reportedly-found.... Technical users can limit tracking by using email relays, but this is a big ask for non-technical users.
RoyTyrell 3y ago
I have multiple email addresses based on use and how much I trust the entity collecting: - My main personal address is the most protected and only give it out to friends, bank, family, etc. - I have another address that I give out to Amazon, ebay, couple other trusted merchants and websites. - Next lay down, one I use for merchants I don't particularly trust like AliExpress. In addition, I only use the credit card that lets me generate a number, set max spending limit, and expiration. - Finally I have a couple that I use for general websites that I figure either could get hacked or I don't trust at all. While not 100% accurate, I can tell who has sold or "lost" my info based on the spam I receive. My main personal has some spam but I think it stems from contacts that had their accounts compromised and their contact list was snarfed. Overall the less I assume I can trust the other entity the more spam that account has. It is funny how accurate the tracking is though. I can search for something on my gaming pc and then a week later I see related ads on Youtube and sometimes even Tubi. My Amazon account uses a different email address than what I used to search on my gaming pc. While my gaming pc has accessed both gmail accounts, they weren't even logged in at the same time. I suppose they rely on IP address + IP metadata and collected advertising metadata to correlate accounts.
legitster 3y ago
An easier way to spin up emails for every account: For some email providers, if you add a "+" modifier to your email address, anything after the + will be ignored and still routed to your main email address. But email systems will still treat them as unique email addresses. (So abc123+Netflix@gmail.com and abc123+nytimes@gmail.com would both be delivered to abc123@gmail.com. This limits their ability to link your accounts against each other. And you can see if someone shares your data when you start getting hits on your Netflix email address.
- nelsonfigueroa 3y ago
  It seems like some backend code could easily strip the “+” and everything after it before saving an email to a database. Not sure how viable this is but I’ve also never tried it.
  - rantallion 3y ago
    They could, but I'd be surprised if they do. Firstly, we can see that they're using the email exactly as provided (for sending, at least), else filters on the mail we receive wouldn't work. Secondly, the + trick works because it's valid in email addresses under RFC 5321 and RFC 5322 - the fact that Gmail (and others?) direct all addresses of the format 'foo+bar@gmail.com' to the mailbox of 'foo@gmail.com' is a quirk, not a given. Anyone wanting to trim '+bar' would have to know it's safe to do so for particular providers, and I doubt anyone wants to maintain that list and do extra backend work just in case they want to share on the sly.
    - qaisjp 3y ago
      I don't think spammers care if trimming the plus-alias doesn't work for some email providers. Gmail is also pretty popular, so it's not much work to just hardcode it there.
  - legitster 3y ago
    That's the trick - not all email providers behave this way, so systems would have to throw out legitimate emails. Also, most of the automated email systems are not as sophisticated as people think. Ours actually relies on + wildcards for internal testing.
lifestyleguru 3y ago
It's increasingly difficult to change account's email and phone number, some services require selfie or scan of identity document. The fingerprint consisting of email and phone number is slowly becoming digital DNA.
- graphe 3y ago
  Anyone used a good SD model to make a selfie and identity document?
- al_borland 3y ago
  I recently changed my email at a significant number of sites, as Gmail started to require phone numbers and was going to delete my accounts if I didn’t add one to some alternate addresses I had. I didn’t run into the issue you mentioned, but I ran into the issue of Sony (for the PSN) telling me they wouldn’t delete a duplicate PSN account I had (conflicting with their support docs), after I waited 40 minutes to speak to someone. When I tried to bring up the support docs they ended the conversation. I had a similar issue with Rockstar, where I ended up in captcha hell, having to solve 30 puzzles in a row for each login attempt or and again to get into areas of the site to change things. The site would not function. I got fed up to the point of wanting to delete my account. I don’t use it anyway. I did whatever the site said to do, and it said it could take up to 30 day(?). That was probably 3 months ago and I haven’t heard anything. These two things make me uncomfortable deleting one of my Gmail accounts, so it’s still hanging out there.
- waqf 3y ago
  Moving to another country is a nightmare because you cannot bring your phone number. I am currently paying for a US phone number I don't meaningfully use, because it's not clear that all of my important account-holding organizations reliably support a two-factor/login confirmation strategy that isn't "US phone number".
luzhishen 3y ago
Simplelogin has solved this for me. Took a bit of setting up to change over emails but I'm glad I did.
dsizzle 3y ago
https://archive.is/xW1Xl https://archive.is/xW1Xl
zahma 3y ago
Firefox Relay is a handy assistant to at least stymie email tracking and is neatly integrated with the browser. The free tier gets you a few masked emails that forward to your actual inbox. You can't reply through the masked email without paying, but that might not be necessary for all. It feels like retaining some semblance of privacy is a losing battle. Data clean rooms are industry standard now and many companies happily share their bounties with others for profit. That appears to be the future along with consolidating businesses based on data-driven insights for demographics. How are these kinds of practices still legal? When does data collection and sharing become such a glaring issue that constitutional rights can be invoked in a landmark lawsuit? Or can we expect anti-trust suits to limit companies hoarding vast repositories of data? It feels naive to ask these questions, but they're fundamental to societal health and progress, democracy, and arguably the planet. https://relay.firefox.com/ https://relay.firefox.com/
- seszett 3y ago
  > How are these kinds of practices still legal? In the EU they are not, and as someone who has been using a custom email address for almost every service for the last 15 years or so, I have noticed that this almost doesn't happen anymore. The only cases where an email address receives spam anymore is after breaches, or very old addresses that have been sold more than 10 years ago.
333ads 3y ago
I've found fastmail's masked email to be a great solution to this. I don't give any services my primary address these days.
- frereubu 3y ago
  I tried this, but the thing I didn't like about it was that it ties you into Fastmail. I like using a custom domain so it's relatively easy to change your email provider, but masked emails are in the format xxx.xxx@fastmail.com so you'd need to revisit all of those accounts if you want to change your email provider to someone else. I'm currently trying using a catch-all with servicename@mydomain.com, and will be interested to see how much extra spam comes in through the catch-all.
  - 333ads 3y ago
    I get that. If (and when) I change email providers it'll be a pain. My gripe with a custom domain is that it'd uniquely identify me. I prefer to hide behind fastmail.
  - cheerylion 3y ago
    You can set the Masked Email function to use a custom domain: https://www.fastmail.help/hc/en-us/articles/4406536368911-Masked-Email#domain https://www.fastmail.help/hc/en-us/articles/4406536368911-Ma... I do this with a generic-sounding domain (...mail.tld), and I purposefully don't have catch-all enabled for this domain. That way, when I disable a masked address I completely block the service I used it for from sending me emails. To further reduce ties to Fastmail, I believe you can export a list of all your e-mail addresses used.
    - frereubu 3y ago
      Oh, thanks! I'll take a look at that.
hnbear 3y ago
Currently I use Fastmail to host my own domain, and then for every new service I save the account in 1Password using service@service.mydomain.com It's a bit extreme, but surprisingly little extra effort. That said, most of the accounts I create are throwaway. For phone numbers I have an old, unused Google voice number I give out. It's a real number, but never checked, except for once every 90? days, to keep it active. I'd love it if OnePassword integrated with something like https://randomuser.me https://randomuser.me to generate a new profile for every awful service that needs an account to work.
- rnoises 3y ago
  Not quite randomuser.me, but 1Password integrates with Fastmail to generate masked emails on the fly. https://1password.com/fastmail/ https://1password.com/fastmail/
  - hnbear 3y ago
    Yeah, I tried that for a while, and I have some Apple generated forwarders too. In the end in places like a store that wants you to sign-up for X% off, or something it's easier to just to give them storename@domain.com and see what happens. It's actually pretty low friction in terms of management.
    - frereubu 3y ago
      As I said elsewhere in the comments here, I didn't like the xxx.xxx@fastmail.com format of masked emails because if you're using a custom domain and you have 200 logins using masked email addresses, then want to change your email service, you have go through those 200 services updating the email address for each one. I'm trying the same setup as you suggest above on the basis that Fastmail allows you to block specific email addresses in case you start getting lots of spam to a specific address through the catch-all.
      - hnbear 3y ago
        Yes, custom domain future proofs it. You can route that domain’s email to any servers via MX records. I have put in some blocks before where services don’t let you unsubscribe.
asimpletune 3y ago
Apple’s “hide my email” feature is nice for this stuff
- maxclark 3y ago
  How do you burn generated emails?
  - asimpletune 3y ago
    Under settings you can find the email you want and deactivate it.
- jrnichols 3y ago
  agreed. "Sign in with Apple" has been fantastic.
  - asimpletune 3y ago
    We’re actually talking about two different features.
GrabbinD33ze69 3y ago
Duck addresses from duckduckgo are a nice way to mitigate this.
advael 3y ago
It's pretty ridiculous to think we can win a cat-and-mouse game of surveillance mitigation as individuals against some of the world's largest corporations. Some web services/sites are even starting to create nuisance hurdles around VPNs they know about, if they don't just block them outright, China style. We need to make surveillance of this kind a crime to make it stop. We need privacy laws that are comprehensive and have teeth.
jollyoldpirate 3y ago
Lol oh no I’m petrified.
wkat4242 3y ago
This is ummm... news? I thought since the spam floods of the early 2000s everyone knew not to put their real email to get that 5€ off coupon. Of course tracking is a thing now too. But most people I know, even non techies are aware of that and very reluctant to give any information.
- veryfancy 3y ago
  It is surely news to some.
- tomjupiter 3y ago
  The "how" was news to me. I had not heard of Unified ID 2.0 before.
rr808 3y ago
> It acts as a digital bread crumb for companies to link your activity across sites and apps to serve you relevant ads. Isn't this kinda normal now anyway? Like its a fact of life, not much you can do about it, why not hand out your email, its probably out there already anyway. (OTOH I change my email every 5 years or so)
Aardwolf 3y ago
For emails you can register multiple different ones, that's not (easily) possible with phone numbers, and those are what everyone wants now
robotshmobot 3y ago
I’ve been using addy.io for quite some time now. I have a burner tld and every time I sign up for something new I input servicename@mytld.com. Addy forwards that email to the email I have chosen. Works doubly better if you don’t use gmail as your inbox.
- fmajid 3y ago
  I do the same using self-hosted email, and wrote a web UI for Postfix virtual domain management to streamline this: https://github.com/fazalmajid/postmapweb https://github.com/fazalmajid/postmapweb
DavideNL 3y ago
Note that other than Mozilla’s Firefox Relay and Apple’s Hide My Email there's also SimpleLogin: https://simplelogin.io/ https://simplelogin.io/ Also the Bitwarden password manager has an integration for SimpleLogin.
kkfx 3y ago
I have a gazillion of aliases and I use them abundantly...

38 points by cebert 3y ago

Listening to Security Now Episode 961 (https://twit.tv/shows/security-now/episodes/961 https://twit.tv/shows/security-now/episodes/961) highlighted a trend where sites like FoxNews.com require email sharing and agreeing to terms of service before content can be viewed. Delving into Fox News' Privacy Policy, it's clear the extent of data collection and sharing is vast, including personal and activity data, with provisions for third-party sharing for advertising. Such practices raise serious privacy concerns, especially given the extensive user profiling and data monetization involved. This approach could set a worrying precedent for content access, prioritizing data collection over user privacy (https://www.foxnews.com/privacy-policy#fi https://www.foxnews.com/privacy-policy#fi). I don't care about Fox News specifically, but I hope this trend requiring sharing an email address to view ad-supported content doesn't become more popular. An example of this on Fox News is this article, which requires an email address to view: https://www.foxnews.com/world/navalnys-body-reportedly-found-signs-bruising-russia-claims-he-died-sudden-death-syndrome https://www.foxnews.com/world/navalnys-body-reportedly-found.... Technical users can limit tracking by using email relays, but this is a big ask for non-technical users.

RoyTyrell 3y ago

I have multiple email addresses based on use and how much I trust the entity collecting: - My main personal address is the most protected and only give it out to friends, bank, family, etc. - I have another address that I give out to Amazon, ebay, couple other trusted merchants and websites. - Next lay down, one I use for merchants I don't particularly trust like AliExpress. In addition, I only use the credit card that lets me generate a number, set max spending limit, and expiration. - Finally I have a couple that I use for general websites that I figure either could get hacked or I don't trust at all. While not 100% accurate, I can tell who has sold or "lost" my info based on the spam I receive. My main personal has some spam but I think it stems from contacts that had their accounts compromised and their contact list was snarfed. Overall the less I assume I can trust the other entity the more spam that account has. It is funny how accurate the tracking is though. I can search for something on my gaming pc and then a week later I see related ads on Youtube and sometimes even Tubi. My Amazon account uses a different email address than what I used to search on my gaming pc. While my gaming pc has accessed both gmail accounts, they weren't even logged in at the same time. I suppose they rely on IP address + IP metadata and collected advertising metadata to correlate accounts.

legitster 3y ago

An easier way to spin up emails for every account: For some email providers, if you add a "+" modifier to your email address, anything after the + will be ignored and still routed to your main email address. But email systems will still treat them as unique email addresses. (So abc123+Netflix@gmail.com and abc123+nytimes@gmail.com would both be delivered to abc123@gmail.com. This limits their ability to link your accounts against each other. And you can see if someone shares your data when you start getting hits on your Netflix email address.

nelsonfigueroa 3y ago
It seems like some backend code could easily strip the “+” and everything after it before saving an email to a database. Not sure how viable this is but I’ve also never tried it.
- rantallion 3y ago
  They could, but I'd be surprised if they do. Firstly, we can see that they're using the email exactly as provided (for sending, at least), else filters on the mail we receive wouldn't work. Secondly, the + trick works because it's valid in email addresses under RFC 5321 and RFC 5322 - the fact that Gmail (and others?) direct all addresses of the format 'foo+bar@gmail.com' to the mailbox of 'foo@gmail.com' is a quirk, not a given. Anyone wanting to trim '+bar' would have to know it's safe to do so for particular providers, and I doubt anyone wants to maintain that list and do extra backend work just in case they want to share on the sly.
  - qaisjp 3y ago
    I don't think spammers care if trimming the plus-alias doesn't work for some email providers. Gmail is also pretty popular, so it's not much work to just hardcode it there.
- legitster 3y ago
  That's the trick - not all email providers behave this way, so systems would have to throw out legitimate emails. Also, most of the automated email systems are not as sophisticated as people think. Ours actually relies on + wildcards for internal testing.

lifestyleguru 3y ago

It's increasingly difficult to change account's email and phone number, some services require selfie or scan of identity document. The fingerprint consisting of email and phone number is slowly becoming digital DNA.

graphe 3y ago
Anyone used a good SD model to make a selfie and identity document?
al_borland 3y ago
I recently changed my email at a significant number of sites, as Gmail started to require phone numbers and was going to delete my accounts if I didn’t add one to some alternate addresses I had. I didn’t run into the issue you mentioned, but I ran into the issue of Sony (for the PSN) telling me they wouldn’t delete a duplicate PSN account I had (conflicting with their support docs), after I waited 40 minutes to speak to someone. When I tried to bring up the support docs they ended the conversation. I had a similar issue with Rockstar, where I ended up in captcha hell, having to solve 30 puzzles in a row for each login attempt or and again to get into areas of the site to change things. The site would not function. I got fed up to the point of wanting to delete my account. I don’t use it anyway. I did whatever the site said to do, and it said it could take up to 30 day(?). That was probably 3 months ago and I haven’t heard anything. These two things make me uncomfortable deleting one of my Gmail accounts, so it’s still hanging out there.
waqf 3y ago
Moving to another country is a nightmare because you cannot bring your phone number. I am currently paying for a US phone number I don't meaningfully use, because it's not clear that all of my important account-holding organizations reliably support a two-factor/login confirmation strategy that isn't "US phone number".

luzhishen 3y ago

Simplelogin has solved this for me. Took a bit of setting up to change over emails but I'm glad I did.

dsizzle 3y ago

https://archive.is/xW1Xl https://archive.is/xW1Xl

zahma 3y ago

Firefox Relay is a handy assistant to at least stymie email tracking and is neatly integrated with the browser. The free tier gets you a few masked emails that forward to your actual inbox. You can't reply through the masked email without paying, but that might not be necessary for all. It feels like retaining some semblance of privacy is a losing battle. Data clean rooms are industry standard now and many companies happily share their bounties with others for profit. That appears to be the future along with consolidating businesses based on data-driven insights for demographics. How are these kinds of practices still legal? When does data collection and sharing become such a glaring issue that constitutional rights can be invoked in a landmark lawsuit? Or can we expect anti-trust suits to limit companies hoarding vast repositories of data? It feels naive to ask these questions, but they're fundamental to societal health and progress, democracy, and arguably the planet. https://relay.firefox.com/ https://relay.firefox.com/

seszett 3y ago
> How are these kinds of practices still legal? In the EU they are not, and as someone who has been using a custom email address for almost every service for the last 15 years or so, I have noticed that this almost doesn't happen anymore. The only cases where an email address receives spam anymore is after breaches, or very old addresses that have been sold more than 10 years ago.

333ads 3y ago

I've found fastmail's masked email to be a great solution to this. I don't give any services my primary address these days.

frereubu 3y ago
I tried this, but the thing I didn't like about it was that it ties you into Fastmail. I like using a custom domain so it's relatively easy to change your email provider, but masked emails are in the format xxx.xxx@fastmail.com so you'd need to revisit all of those accounts if you want to change your email provider to someone else. I'm currently trying using a catch-all with servicename@mydomain.com, and will be interested to see how much extra spam comes in through the catch-all.
- 333ads 3y ago
  I get that. If (and when) I change email providers it'll be a pain. My gripe with a custom domain is that it'd uniquely identify me. I prefer to hide behind fastmail.
- cheerylion 3y ago
  You can set the Masked Email function to use a custom domain: https://www.fastmail.help/hc/en-us/articles/4406536368911-Masked-Email#domain https://www.fastmail.help/hc/en-us/articles/4406536368911-Ma... I do this with a generic-sounding domain (...mail.tld), and I purposefully don't have catch-all enabled for this domain. That way, when I disable a masked address I completely block the service I used it for from sending me emails. To further reduce ties to Fastmail, I believe you can export a list of all your e-mail addresses used.
  - frereubu 3y ago
    Oh, thanks! I'll take a look at that.

hnbear 3y ago

Currently I use Fastmail to host my own domain, and then for every new service I save the account in 1Password using service@service.mydomain.com It's a bit extreme, but surprisingly little extra effort. That said, most of the accounts I create are throwaway. For phone numbers I have an old, unused Google voice number I give out. It's a real number, but never checked, except for once every 90? days, to keep it active. I'd love it if OnePassword integrated with something like https://randomuser.me https://randomuser.me to generate a new profile for every awful service that needs an account to work.

rnoises 3y ago
Not quite randomuser.me, but 1Password integrates with Fastmail to generate masked emails on the fly. https://1password.com/fastmail/ https://1password.com/fastmail/
- hnbear 3y ago
  Yeah, I tried that for a while, and I have some Apple generated forwarders too. In the end in places like a store that wants you to sign-up for X% off, or something it's easier to just to give them storename@domain.com and see what happens. It's actually pretty low friction in terms of management.
  - frereubu 3y ago
    As I said elsewhere in the comments here, I didn't like the xxx.xxx@fastmail.com format of masked emails because if you're using a custom domain and you have 200 logins using masked email addresses, then want to change your email service, you have go through those 200 services updating the email address for each one. I'm trying the same setup as you suggest above on the basis that Fastmail allows you to block specific email addresses in case you start getting lots of spam to a specific address through the catch-all.
    - hnbear 3y ago
      Yes, custom domain future proofs it. You can route that domain’s email to any servers via MX records. I have put in some blocks before where services don’t let you unsubscribe.

asimpletune 3y ago

Apple’s “hide my email” feature is nice for this stuff

maxclark 3y ago
How do you burn generated emails?
- asimpletune 3y ago
  Under settings you can find the email you want and deactivate it.
jrnichols 3y ago
agreed. "Sign in with Apple" has been fantastic.
- asimpletune 3y ago
  We’re actually talking about two different features.

GrabbinD33ze69 3y ago

Duck addresses from duckduckgo are a nice way to mitigate this.

advael 3y ago

It's pretty ridiculous to think we can win a cat-and-mouse game of surveillance mitigation as individuals against some of the world's largest corporations. Some web services/sites are even starting to create nuisance hurdles around VPNs they know about, if they don't just block them outright, China style. We need to make surveillance of this kind a crime to make it stop. We need privacy laws that are comprehensive and have teeth.

jollyoldpirate 3y ago

Lol oh no I’m petrified.

wkat4242 3y ago

This is ummm... news? I thought since the spam floods of the early 2000s everyone knew not to put their real email to get that 5€ off coupon. Of course tracking is a thing now too. But most people I know, even non techies are aware of that and very reluctant to give any information.

veryfancy 3y ago
It is surely news to some.
tomjupiter 3y ago
The "how" was news to me. I had not heard of Unified ID 2.0 before.

rr808 3y ago

> It acts as a digital bread crumb for companies to link your activity across sites and apps to serve you relevant ads. Isn't this kinda normal now anyway? Like its a fact of life, not much you can do about it, why not hand out your email, its probably out there already anyway. (OTOH I change my email every 5 years or so)

Aardwolf 3y ago

For emails you can register multiple different ones, that's not (easily) possible with phone numbers, and those are what everyone wants now

robotshmobot 3y ago

I’ve been using addy.io for quite some time now. I have a burner tld and every time I sign up for something new I input servicename@mytld.com. Addy forwards that email to the email I have chosen. Works doubly better if you don’t use gmail as your inbox.

fmajid 3y ago
I do the same using self-hosted email, and wrote a web UI for Postfix virtual domain management to streamline this: https://github.com/fazalmajid/postmapweb https://github.com/fazalmajid/postmapweb

DavideNL 3y ago

Note that other than Mozilla’s Firefox Relay and Apple’s Hide My Email there's also SimpleLogin: https://simplelogin.io/ https://simplelogin.io/ Also the Bitwarden password manager has an integration for SimpleLogin.

kkfx 3y ago

I have a gazillion of aliases and I use them abundantly...