9 ms·

Currently I use Fastmail to host my own domain, and then for every new service I save the account in 1Password using service@service.mydomain.com It's a bit ex

by hnbear 3y ago

Currently I use Fastmail to host my own domain, and then for every new service I save the account in 1Password using service@service.mydomain.com It's a bit extreme, but surprisingly little extra effort. That said, most of the accounts I create are throwaway. For phone numbers I have an old, unused Google voice number I give out. It's a real number, but never checked, except for once every 90? days, to keep it active. I'd love it if OnePassword integrated with something like https://randomuser.me https://randomuser.me to generate a new profile for every awful service that needs an account to work.

rnoises 3y ago
Not quite randomuser.me, but 1Password integrates with Fastmail to generate masked emails on the fly. https://1password.com/fastmail/ https://1password.com/fastmail/
- hnbear 3y ago
  Yeah, I tried that for a while, and I have some Apple generated forwarders too. In the end in places like a store that wants you to sign-up for X% off, or something it's easier to just to give them storename@domain.com and see what happens. It's actually pretty low friction in terms of management.
  - frereubu 3y ago
    As I said elsewhere in the comments here, I didn't like the xxx.xxx@fastmail.com format of masked emails because if you're using a custom domain and you have 200 logins using masked email addresses, then want to change your email service, you have go through those 200 services updating the email address for each one. I'm trying the same setup as you suggest above on the basis that Fastmail allows you to block specific email addresses in case you start getting lots of spam to a specific address through the catch-all.
    - hnbear 3y ago
      Yes, custom domain future proofs it. You can route that domain’s email to any servers via MX records. I have put in some blocks before where services don’t let you unsubscribe.
WA 3y ago
Your own domain helps zero to prevent linking your activity across sites. Fastmail masked emails + 1Password helps though.
- seszett 3y ago
  Of course it does, nobody will take into account the special case of people who use subdomains or even just non-standard email address separators, unless they are a rather determined government agency and then all of a sudden almost no method works anymore for privacy. I'm pretty sure even Google doesn't care about the dozens of people who use a different email address for different services.
  - hnbear 3y ago
    This was my thinking here - yes, it has flaws in the approach, but it also gets me out of the main buckets that spammers will hit, and ad brokers will generally be selling. It's a little friction, that maybe goes a long way. Pretty hard to actually evaluate though. Gives me the warm and fuzzies and I got to play around setting it up, so all good there.
dogman144 3y ago
Is your intent privacy? I've thought through similar setups, but if the intent is to break cross-platform correlation to a user/device ID and related de-anonymization, I keep coming back to these questions: - How do I know fastmail doesn't sell data? If every one-time domain is tied to a static fastmail account, and the fastmail account has my real info and sells it, then the obfuscation per-service is moot. - Google certainly is selling data, and its hard to have an account with them that's totally clean and doesn't need an existing "anchored"/tracked piece of infra to set it up (existing phone number, etc). SO, the VOIP number from Google is once again linked up to my IRL data, and the obfuscation is again moot. The best I can think of is the theory that a LLC's privacy protections will be stronger than an individual. If I wrap everything in a LLC (phone provider, AWS acc with services like Chime, etc), then the correlation surface areas looks like a random LLC using all these retail services and its delinked from my IRL, assuming AWS/Google don't protect a LLC's data from selling into adtech (and I speculate it might protect it actually).
- hnbear 3y ago
  I owned and ran my own email domain for a long time. Initially on my own hardware for fun, then a VPS, then GSuite, then Fastmail. That's over around 20 years. So, it wasn't planned - it evolved. Somewhere in the Fastmail era I was reading their docs around wildcarding and thought I'd try it out. My primary domain is my name though, so for extra privacy (anality) I bought another that has no link to me in the name. There are still gaps in it. e.g. any merchant site still needs my physical address, and plenty need my cell number. But, generally, it's just an attempt to minimize a digital footprint and see what privacy I can get. That and just why not? I self-host enough stuff, that I see this as another aspect of the same mentality - having a little more control. It's not perfect security, it's not completely clean. Hopefully it's enough to get me out of the easy target bucket though.
  - dogman144 3y ago
    Makes sense, seems like this setup still has the same issues I brought up, but good to know others are sorting through the same issue. I spent a good while reading about adtech from the practitioner side (i.e. adtech devs) vs. from the privacy side, and it was illuminating. Basically, the fears of privacy advocates get laid out in plain "this is a great feature for user correlation" speak, without any of the feature-masking used when adtech discusses it in privacy terms with privacy-conscious audiences. In short, my takeaway from that research was it only takes 1x merchant or infra provider which can correlate a "masked" domain/VOIP number/PO box with something IRL of yours to basically undo the whole privacy effort. Without ironclad knowledge the vendor doesn't sell data (which is hard to get), it's as good as safely assuming the data got sold (or the pixel in the webpage did it, and so on). Tough to think through! I think LLC'ing ones life, if in the US, is the only way to truly do it or get a reasonably high guarantee. You'd get corporate privacy guarantees which are unfortunately stronger than individual privacy guarantees in the states.
armada651 3y ago
I've been thinking of running a setup like this specifically to rat out who's been selling my e-mail addresses, since the spam would be directed at the service@service.mydomain.com. Did you find any interesting results from your setup? Some surprising services who sold your address?
- frereubu 3y ago
  And did you find you got much spam to non-existent addresses? I used to use a catch-all setup, and got a large amount of spam, but that must have been 25ish years ago.
  - hnbear 3y ago
    Very little. Could also be that Fastmail has good filtering.
    - frereubu 3y ago
      Thanks. I find Fastmail a little worse than Google in terms of spam, but that could just be fluctuations in the amount of spam in general after changing service. (I'm noticing more spam in my work email recently, which uses Google Workspace, too).
- hnbear 3y ago
  Actually, I think it's only happened once or twice in years. I was expecting more spam than I get. Could also be that random domains aren't that valuable to sell.
- wirelesspotat 3y ago
  Not GP but I have the same set up and have only had a couple times where I received unexpected emails to an inbox. One was from GitHub profile scraping, can't remember what the other one was. One of the surprisingly useful areas is with deliveries. Emails from delivery companies (especially from abroad) often don't specify what it is they're delivering or who it's from. But with this set up I can easily check that with the email address they're sending to, to know who it's from
cebert 3y ago
Would one problem with your domain approach be that it’s less anonymous to mailers than if you used a relay services where many users with random email addresses shared the same relay domain?
tetrisgm 3y ago
How do you set your domain on fast mail to use @.domain.com? I only know @.
- WirelessGigabit 3y ago
  (I'm using wrong terminology) It works because if there is no entry for *.domain.com the system will go one level up, to domain.com for the MX records. It even works multi-level, like x.y.domain.com will use the MX records of domain.com (provided there are none for x & y). This is worth mentioning as x.y.domain.com does not work if you have a *.domain.com SSL certificate.
  - tetrisgm 3y ago
    Really? Cool. Would you be comfortable sharing your dns settings and or fastmail domain settings? Cool if no but I wanna give this a go!
    - WirelessGigabit 3y ago
      I don't use fastmail. I use Office365. It seems that fastmail only does *.domain.com and not *.*.domain.com: https://www.fastmail.help/hc/en-us/articles/360060591053-Plus-addressing-and-subdomain-addressing#subdomain https://www.fastmail.help/hc/en-us/articles/360060591053-Plu... Hope that helps

by hnbear 3y ago

rnoises 3y ago

Not quite randomuser.me, but 1Password integrates with Fastmail to generate masked emails on the fly. https://1password.com/fastmail/ https://1password.com/fastmail/

hnbear 3y ago
Yeah, I tried that for a while, and I have some Apple generated forwarders too. In the end in places like a store that wants you to sign-up for X% off, or something it's easier to just to give them storename@domain.com and see what happens. It's actually pretty low friction in terms of management.
- frereubu 3y ago
  As I said elsewhere in the comments here, I didn't like the xxx.xxx@fastmail.com format of masked emails because if you're using a custom domain and you have 200 logins using masked email addresses, then want to change your email service, you have go through those 200 services updating the email address for each one. I'm trying the same setup as you suggest above on the basis that Fastmail allows you to block specific email addresses in case you start getting lots of spam to a specific address through the catch-all.
  - hnbear 3y ago
    Yes, custom domain future proofs it. You can route that domain’s email to any servers via MX records. I have put in some blocks before where services don’t let you unsubscribe.

WA 3y ago

Your own domain helps zero to prevent linking your activity across sites. Fastmail masked emails + 1Password helps though.

seszett 3y ago
Of course it does, nobody will take into account the special case of people who use subdomains or even just non-standard email address separators, unless they are a rather determined government agency and then all of a sudden almost no method works anymore for privacy. I'm pretty sure even Google doesn't care about the dozens of people who use a different email address for different services.
- hnbear 3y ago
  This was my thinking here - yes, it has flaws in the approach, but it also gets me out of the main buckets that spammers will hit, and ad brokers will generally be selling. It's a little friction, that maybe goes a long way. Pretty hard to actually evaluate though. Gives me the warm and fuzzies and I got to play around setting it up, so all good there.

dogman144 3y ago

Is your intent privacy? I've thought through similar setups, but if the intent is to break cross-platform correlation to a user/device ID and related de-anonymization, I keep coming back to these questions: - How do I know fastmail doesn't sell data? If every one-time domain is tied to a static fastmail account, and the fastmail account has my real info and sells it, then the obfuscation per-service is moot. - Google certainly is selling data, and its hard to have an account with them that's totally clean and doesn't need an existing "anchored"/tracked piece of infra to set it up (existing phone number, etc). SO, the VOIP number from Google is once again linked up to my IRL data, and the obfuscation is again moot. The best I can think of is the theory that a LLC's privacy protections will be stronger than an individual. If I wrap everything in a LLC (phone provider, AWS acc with services like Chime, etc), then the correlation surface areas looks like a random LLC using all these retail services and its delinked from my IRL, assuming AWS/Google don't protect a LLC's data from selling into adtech (and I speculate it might protect it actually).

hnbear 3y ago
I owned and ran my own email domain for a long time. Initially on my own hardware for fun, then a VPS, then GSuite, then Fastmail. That's over around 20 years. So, it wasn't planned - it evolved. Somewhere in the Fastmail era I was reading their docs around wildcarding and thought I'd try it out. My primary domain is my name though, so for extra privacy (anality) I bought another that has no link to me in the name. There are still gaps in it. e.g. any merchant site still needs my physical address, and plenty need my cell number. But, generally, it's just an attempt to minimize a digital footprint and see what privacy I can get. That and just why not? I self-host enough stuff, that I see this as another aspect of the same mentality - having a little more control. It's not perfect security, it's not completely clean. Hopefully it's enough to get me out of the easy target bucket though.
- dogman144 3y ago
  Makes sense, seems like this setup still has the same issues I brought up, but good to know others are sorting through the same issue. I spent a good while reading about adtech from the practitioner side (i.e. adtech devs) vs. from the privacy side, and it was illuminating. Basically, the fears of privacy advocates get laid out in plain "this is a great feature for user correlation" speak, without any of the feature-masking used when adtech discusses it in privacy terms with privacy-conscious audiences. In short, my takeaway from that research was it only takes 1x merchant or infra provider which can correlate a "masked" domain/VOIP number/PO box with something IRL of yours to basically undo the whole privacy effort. Without ironclad knowledge the vendor doesn't sell data (which is hard to get), it's as good as safely assuming the data got sold (or the pixel in the webpage did it, and so on). Tough to think through! I think LLC'ing ones life, if in the US, is the only way to truly do it or get a reasonably high guarantee. You'd get corporate privacy guarantees which are unfortunately stronger than individual privacy guarantees in the states.

armada651 3y ago

I've been thinking of running a setup like this specifically to rat out who's been selling my e-mail addresses, since the spam would be directed at the service@service.mydomain.com. Did you find any interesting results from your setup? Some surprising services who sold your address?

frereubu 3y ago
And did you find you got much spam to non-existent addresses? I used to use a catch-all setup, and got a large amount of spam, but that must have been 25ish years ago.
- hnbear 3y ago
  Very little. Could also be that Fastmail has good filtering.
  - frereubu 3y ago
    Thanks. I find Fastmail a little worse than Google in terms of spam, but that could just be fluctuations in the amount of spam in general after changing service. (I'm noticing more spam in my work email recently, which uses Google Workspace, too).
hnbear 3y ago
Actually, I think it's only happened once or twice in years. I was expecting more spam than I get. Could also be that random domains aren't that valuable to sell.
wirelesspotat 3y ago
Not GP but I have the same set up and have only had a couple times where I received unexpected emails to an inbox. One was from GitHub profile scraping, can't remember what the other one was. One of the surprisingly useful areas is with deliveries. Emails from delivery companies (especially from abroad) often don't specify what it is they're delivering or who it's from. But with this set up I can easily check that with the email address they're sending to, to know who it's from

cebert 3y ago

Would one problem with your domain approach be that it’s less anonymous to mailers than if you used a relay services where many users with random email addresses shared the same relay domain?

tetrisgm 3y ago

How do you set your domain on fast mail to use @.domain.com? I only know @.

WirelessGigabit 3y ago
(I'm using wrong terminology) It works because if there is no entry for *.domain.com the system will go one level up, to domain.com for the MX records. It even works multi-level, like x.y.domain.com will use the MX records of domain.com (provided there are none for x & y). This is worth mentioning as x.y.domain.com does not work if you have a *.domain.com SSL certificate.
- tetrisgm 3y ago
  Really? Cool. Would you be comfortable sharing your dns settings and or fastmail domain settings? Cool if no but I wanna give this a go!
  - WirelessGigabit 3y ago
    I don't use fastmail. I use Office365. It seems that fastmail only does *.domain.com and not *.*.domain.com: https://www.fastmail.help/hc/en-us/articles/360060591053-Plus-addressing-and-subdomain-addressing#subdomain https://www.fastmail.help/hc/en-us/articles/360060591053-Plu... Hope that helps