4 ms·

> they are very hard to identify as being spam For every account I create on the internet I create a new mail inbox, this way I can just compare the email titl

by nzach 2y ago

> they are very hard to identify as being spam For every account I create on the internet I create a new mail inbox, this way I can just compare the email title with the inbox it was sent to. So, when I receive a notice from my bank on my github email I know what happened. This genuinely saved me a few times already.

RandomBacon 2y ago
Same, but I use a catch-all, not separate inboxes. I've caught a couple of hacked or sold email lists, but nothing that drastic yet. One organization posted the email address I gave them on a public contact list webpage, so I get spam/phishing at that one. Using a catch-all is the easiest way to do this, and I highly recommend it for other people.
- cafeinux 2y ago
  May I ask what E-mail provider you use? Or do you run your own mail server?
  - Moru 2y ago
    (not GP) Most providers let you run a catch-all adress on your own domain. You usually set it up with just a check-box "catch-all" and where to send all mail, or you write the username as "*" in an alias.
    - mvolfik 2y ago
      Not GP either, but this. To name a specific provider, I use improvmx.com. They have a generous free tier, I eventually switched to some low paid tier. Not affiliated, happy user.
  - RandomBacon 2y ago
    Fastmail
KarlKode 2y ago
Yup. Got my own domain(s) and use a different address for all my services (like with Gmail where you could append +service to your email but with a completely distinct email per service like paypal@mydomain.com). Helped my several times to identify spam & phishing without even having to check the E-Mail itself.
- nzach 2y ago
  My guess is that you probably know what I'm going to write, but a lot of people don't realize this 'Gmail trick' doesn't really work. The problem is that foo+bar@gmail.com and foo@gmail.com are delivered to the same inbox, so if you are trying to scam someone it is safe to remove anything after the + in a gmail address. And having a custom domain on gmail doesn't improve your situation, because with just a simple 'dig mx' you can know if the domain is hosted on gmail and apply the same regex to remove all labels. So, to be less inflammatory the feature works as expected. But it only protects you if the bad actor is really dumb/lazy or if he is honest.
  - deleted 2y ago
    [deleted]
  - radlad 2y ago
    If everything goes to a + address, then any email sent to your base address is invalid and can be trashed.
    - nzach 2y ago
      Some people really love putting dumb validation rules for emails in forms... You would be surprised to know how many system in the real world will just refuse anything that is not a letter or a number in your email. And the 'fuck them, I won't do business with them' attitude doesn't really work if the system that wont accept your email is the local gas company. And there is another problem, some systems will just remove any label without informing you. I've had this problem logging in some random websites. My account was created with foo+bar@gmail.com but to log I had to use foo@gmail.com.
cookiengineer 2y ago
I use a similar approach due to me having the luxury of an owned domain. The problem, however, is that most companies still rely on crappy Enterprise services like Microsoft Office. For most people managing identities like this is impossible to do - due to either lack of user-friendly options or due to too high thresholds of necessary IT knowledge. I mean, we are speaking about having to configure Dovecot and Postfix and similar tools, and I fuck that up regularly. And we are also assuming that they have to be unguessable (you have github@? maybe I should target linkedin@, too, then!) which implies that they have to be random-looking which means they will likely be blocked by registration filters. Newer projects like Maddy [1] kind of go towards that direction, but are still targeted at developers or sysadmins. [1] https://github.com/foxcpp/maddy https://github.com/foxcpp/maddy
- giancarlostoro 2y ago
  Microsoft used to let you get 500 free emails under any domain you added, for years. I miss those years. Had the nice benefit of putting you into Microsoft's ecosystem. I was able to make emails for different sites too.
- nzach 2y ago
  > configure Dovecot and Postfix 'Creating a new inbox' was an exaggeration on my part. What I have is a catchall on my fastmail account. But when I talk about creating creating inboxes it seems to make it easier for normal people to understand what I'm doing and the benefits it brings. > we are also assuming that they have to be unguessable That would be nice, but I don't have a nice way of doing it. I've tried to use something like rot13 to make it less obvious, but it is a pain to manage it. It would be nice it existed a cypher that was pretty easy to do in my head, but I never found anything like this. > you have github@? maybe I should target linkedin@, too, then! Yes, this is a problem. For a targeted attack this may become a weakpoint in my defense. But this is a calculated risk I'm willing to accept for now.
jnsie 2y ago
I'm curious - is there a benefit to doing so versus using Apple's Hide My Email (or a similar service) or appending +service to a gmail email address? Completely ignorant on the topic so apologies if this is a silly question.
- nzach 2y ago
  I'm not really sure how Apple's Hide My Email works, but my impression is they work by creating a proxy email for you. If that is the case, it should be a good solution for protecting you privacy. The problem is you become hostage to Apple, because now if you loose access to your Apple account you also loose access to ALL your accounts(potentially). It's probably on the same level as using a password manager like BitWarden. I've just explained the problem with the gmail tagging in another comment.
D-Coder 2y ago
This feature is available for no extra cost from panix.com with the "+" (dcoder+anytext@panix.com) technique, and I can use filters on the address. Since many sites can't believe that an email address can have a "+", I can also use "anytext@dcoder.users.panix.com" at most sites instead of dcoder@panix.com. ("anytext" typically, for me, being the name of the company or organization that I'm dealing with. Also, my Panix account is not really "dcoder".)
- sangnoir 2y ago
  Spammers know of the "+" trick, which was popularized by GMail. If they have any level of sophistication at all, they'll /+.*@/@/
  - alach11 2y ago
    Sounds like it's time for someone to set up an email service that offers the same functionality without the +. There would be some headaches and it would limit the degrees of freedom users have with base email addresses, but I'd use it!
    - nzach 2y ago
      Fastmail already provides this feature if you have a custom domain. If you have 'domain.com' you can receive emails either on 'foo@domain.com' or 'bar@foo.domain.com' without problems.
    - pavel_lishin 2y ago
      It sounds like panix already did.
    - kreyenborgi 2y ago
      Fastmail lets you make as many redirects as you want, no + in them. You can even get an api key for it and plug that into bitwarden, so that when you sign up for whatever, you click bitwarden, generate password, generate email, sign in and it's all set. So smooth. (I sound like an ad, but internet pinky promise no affiliation)
wodenokoto 2y ago
Tried signing up with Samsung using username+samsung@gmail.com and was told my email contained illegal word. I don't know what they are thinking. Isn't it a real family name in Korea?
- deleted 2y ago
  [deleted]
- culturestate 2y ago
  As far as I know Samsung isn't a Korean family name, it's just a brand. That said, are you sure it wasn't the + that caused the problem? I've run into that a few times, presumably when someone tried to roll their own email validation.
  - Moru 2y ago
    Sometimes you can sign up with the + but when you try to log in either on the homepage or an app, the login is invalid because of that + sign. Different validations. Stopped using that way after getting locked out of accounts 6 months later...
  - codingminds 2y ago
    It's probably a specific policy of Samsung which doesn't allow the word samsung in recipient addresses. I had the same issue, but with samsung@private-domain.tld gnusmas@private-domain.tld worked just fine..
- close04 2y ago
  My usual "smasung" typo worked fine when I registered with them. I use a service for disposable addresses redirected to my main mailbox for potentially spammy registrations which I don't really care about, instead of just creating new accounts which is way too inconvenient to manage. I'll make these intentional letter swaps every time just to avoid regexes and automatic filters.
  - nubinetwork 2y ago

by nzach 2y ago

RandomBacon 2y ago

Same, but I use a catch-all, not separate inboxes. I've caught a couple of hacked or sold email lists, but nothing that drastic yet. One organization posted the email address I gave them on a public contact list webpage, so I get spam/phishing at that one. Using a catch-all is the easiest way to do this, and I highly recommend it for other people.

cafeinux 2y ago
May I ask what E-mail provider you use? Or do you run your own mail server?
- Moru 2y ago
  (not GP) Most providers let you run a catch-all adress on your own domain. You usually set it up with just a check-box "catch-all" and where to send all mail, or you write the username as "*" in an alias.
  - mvolfik 2y ago
    Not GP either, but this. To name a specific provider, I use improvmx.com. They have a generous free tier, I eventually switched to some low paid tier. Not affiliated, happy user.
- RandomBacon 2y ago
  Fastmail

KarlKode 2y ago

Yup. Got my own domain(s) and use a different address for all my services (like with Gmail where you could append +service to your email but with a completely distinct email per service like paypal@mydomain.com). Helped my several times to identify spam & phishing without even having to check the E-Mail itself.

nzach 2y ago
My guess is that you probably know what I'm going to write, but a lot of people don't realize this 'Gmail trick' doesn't really work. The problem is that foo+bar@gmail.com and foo@gmail.com are delivered to the same inbox, so if you are trying to scam someone it is safe to remove anything after the + in a gmail address. And having a custom domain on gmail doesn't improve your situation, because with just a simple 'dig mx' you can know if the domain is hosted on gmail and apply the same regex to remove all labels. So, to be less inflammatory the feature works as expected. But it only protects you if the bad actor is really dumb/lazy or if he is honest.
- deleted 2y ago
  [deleted]
- radlad 2y ago
  If everything goes to a + address, then any email sent to your base address is invalid and can be trashed.
  - nzach 2y ago
    Some people really love putting dumb validation rules for emails in forms... You would be surprised to know how many system in the real world will just refuse anything that is not a letter or a number in your email. And the 'fuck them, I won't do business with them' attitude doesn't really work if the system that wont accept your email is the local gas company. And there is another problem, some systems will just remove any label without informing you. I've had this problem logging in some random websites. My account was created with foo+bar@gmail.com but to log I had to use foo@gmail.com.

cookiengineer 2y ago

I use a similar approach due to me having the luxury of an owned domain. The problem, however, is that most companies still rely on crappy Enterprise services like Microsoft Office. For most people managing identities like this is impossible to do - due to either lack of user-friendly options or due to too high thresholds of necessary IT knowledge. I mean, we are speaking about having to configure Dovecot and Postfix and similar tools, and I fuck that up regularly. And we are also assuming that they have to be unguessable (you have github@? maybe I should target linkedin@, too, then!) which implies that they have to be random-looking which means they will likely be blocked by registration filters. Newer projects like Maddy [1] kind of go towards that direction, but are still targeted at developers or sysadmins. [1] https://github.com/foxcpp/maddy https://github.com/foxcpp/maddy

giancarlostoro 2y ago
Microsoft used to let you get 500 free emails under any domain you added, for years. I miss those years. Had the nice benefit of putting you into Microsoft's ecosystem. I was able to make emails for different sites too.
nzach 2y ago
> configure Dovecot and Postfix 'Creating a new inbox' was an exaggeration on my part. What I have is a catchall on my fastmail account. But when I talk about creating creating inboxes it seems to make it easier for normal people to understand what I'm doing and the benefits it brings. > we are also assuming that they have to be unguessable That would be nice, but I don't have a nice way of doing it. I've tried to use something like rot13 to make it less obvious, but it is a pain to manage it. It would be nice it existed a cypher that was pretty easy to do in my head, but I never found anything like this. > you have github@? maybe I should target linkedin@, too, then! Yes, this is a problem. For a targeted attack this may become a weakpoint in my defense. But this is a calculated risk I'm willing to accept for now.

jnsie 2y ago

I'm curious - is there a benefit to doing so versus using Apple's Hide My Email (or a similar service) or appending +service to a gmail email address? Completely ignorant on the topic so apologies if this is a silly question.

nzach 2y ago
I'm not really sure how Apple's Hide My Email works, but my impression is they work by creating a proxy email for you. If that is the case, it should be a good solution for protecting you privacy. The problem is you become hostage to Apple, because now if you loose access to your Apple account you also loose access to ALL your accounts(potentially). It's probably on the same level as using a password manager like BitWarden. I've just explained the problem with the gmail tagging in another comment.

D-Coder 2y ago

This feature is available for no extra cost from panix.com with the "+" (dcoder+anytext@panix.com) technique, and I can use filters on the address. Since many sites can't believe that an email address can have a "+", I can also use "anytext@dcoder.users.panix.com" at most sites instead of dcoder@panix.com. ("anytext" typically, for me, being the name of the company or organization that I'm dealing with. Also, my Panix account is not really "dcoder".)

sangnoir 2y ago
Spammers know of the "+" trick, which was popularized by GMail. If they have any level of sophistication at all, they'll /+.*@/@/
- alach11 2y ago
  Sounds like it's time for someone to set up an email service that offers the same functionality without the +. There would be some headaches and it would limit the degrees of freedom users have with base email addresses, but I'd use it!
  - nzach 2y ago
    Fastmail already provides this feature if you have a custom domain. If you have 'domain.com' you can receive emails either on 'foo@domain.com' or 'bar@foo.domain.com' without problems.
  - pavel_lishin 2y ago
    It sounds like panix already did.
  - kreyenborgi 2y ago
    Fastmail lets you make as many redirects as you want, no + in them. You can even get an api key for it and plug that into bitwarden, so that when you sign up for whatever, you click bitwarden, generate password, generate email, sign in and it's all set. So smooth. (I sound like an ad, but internet pinky promise no affiliation)

wodenokoto 2y ago

Tried signing up with Samsung using username+samsung@gmail.com and was told my email contained illegal word. I don't know what they are thinking. Isn't it a real family name in Korea?

deleted 2y ago
[deleted]
culturestate 2y ago
As far as I know Samsung isn't a Korean family name, it's just a brand. That said, are you sure it wasn't the + that caused the problem? I've run into that a few times, presumably when someone tried to roll their own email validation.
- Moru 2y ago
  Sometimes you can sign up with the + but when you try to log in either on the homepage or an app, the login is invalid because of that + sign. Different validations. Stopped using that way after getting locked out of accounts 6 months later...
- codingminds 2y ago
  It's probably a specific policy of Samsung which doesn't allow the word samsung in recipient addresses. I had the same issue, but with samsung@private-domain.tld gnusmas@private-domain.tld worked just fine..
close04 2y ago
My usual "smasung" typo worked fine when I registered with them. I use a service for disposable addresses redirected to my main mailbox for potentially spammy registrations which I don't really care about, instead of just creating new accounts which is way too inconvenient to manage. I'll make these intentional letter swaps every time just to avoid regexes and automatic filters.
- nubinetwork 2y ago