6 ms·

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source o

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source of leak by email addresses as well as sources of spam. --- Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header to' (the recipient address you see, sometimes filtering rules don't filter for BCC or sometimes recipients are alias instead of your actual email) that are more comprehensive than normal filtering rules to sort your emails into folders. [1]: https://datatracker.ietf.org/doc/html/rfc5228 https://datatracker.ietf.org/doc/html/rfc5228 --- Amusingly, I've managed to recover old accounts from emails that contains my old passwords with demands for crypto payment, it just provided me enough help to recall old variations of my passwords.

lelandfe 1y ago
(the keyboard smash username is apropos) > Per-account alias might sound much Not only does this not sound too much, this is a feature Apple offers called Hide My Email: https://support.apple.com/en-us/102548 https://support.apple.com/en-us/102548
- fainpul 1y ago
  And one day you've had it with Apple's latest user-hostile shenanigans and switch to Linux. What now? Do you just keep paying for iCloud+ forever?
  - marliechiller 1y ago
    wouldnt this be the case for any vendor you choose?
    - fainpul 1y ago
      yes
    - vladvasiliu 1y ago
      Indeed. But some are easier to change than others. I switched my e-mail provider, and it took all of five minutes to launch the copy of my data. Since I kept the same domain, everyone sending me e-mails didn't notice anything. With Apple's approach, I'd have to go through each account and move it from something@icloud to something@new-domain. However, for people who don't want to mess around with custom domain names and e-mail providers, apple's approach is very practical. You just need to tell it to "hide your email" when you register somewhere and you're good to go.
  - steelframe 1y ago
    In my experience the overwhelming majority of services permit me to change my email address.
    - fainpul 1y ago
      Of course. But I have hundreds of user accounts, as probably many people do. I would not enjoy changing all those email addresses.
- sometimes_all 1y ago
  As someone who uses both, I much rather prefer aliases to hide-my-email for the more important stuff. For one, I can choose the email address "username", which I cannot with Apple's solution. Plus, what happens when I move on from Apple to something else?
  - bn-usd-mistake 1y ago
    But aliases can be easily mapped back to your normal email address, unlike Apple's which are opaque. I, too, am afraid of vendor lock-in though. Sadly, couldn't find a good alternative yet
    - sometimes_all 1y ago
      Not sure where you're coming from - my original email address is not being shown in headers, so those seem fairly opaque. Probably depends on your email provider?
    - ziml77 1y ago
      There's no solution to lock-in because there must be some massively shared domain that the email address exists on for the anonymity of the service to properly work. However if you are simply looking for an alternative to Apple, Fastmail offers a masked email service too.
ekropotin 1y ago
I just use <myname>+<service>@gmail.com At the end of day day it’s all delivered to myname@gmail.com mailbox, but I can use filters based on part after “+”.
- sneak 1y ago
  As someone who deals in breach data this is a simple regex to strip out.
  - mesrik 1y ago
    >As someone who deals in breach data this is a simple regex to strip out. Sure it is, but at least you do get later, post leak, a slight chance find out where leak originated. Data stealers seldom strip out that +extension part before the selling or otherwise dump it somewhere. And while it's passed on, you get to see address as you gave to that party that had leak. Reason seller don't strip of it is perhaps because they sell by number of unique addresses and while +extension usage is quite rare they make more money when they don't strip it off too. Information where it leaked can be very useful information to pass leaker at least up till point they have announced they know about the compromise happened. I've done that since turn of century too many times I've lost count already and been quite many times the first to get them know that they had a problem there. And sure I've received thank you emails that I gave them early head-up info about the issue.
- tapland 1y ago
  Anyone who’s looked at breach data knows to try yourname+service for any service. This does help in filtering spam though
  - selcuka 1y ago
    It doesn't have to be literally the service name. Can be any unique alphanumeric suffix you make up randomly. As long as you use a password manager you don't have to remember it.
    - 1y ago
sometimes_all 1y ago
I also use per-account emails, but not sieve filtering. Catch-all is helpful for throw-aways, aliases for the more important stuff. It's super-easy to figure out who leaks my emails to whom, so I can easily disable both the leaker and the people who leaked. Much more user-friendly than Apple's hide-my-email.
scoot 1y ago
> I used per-account email [addresses] with alias services I do too (anything@mysubdomain.example.com), but but online services collude with data brokers to share so much information [0] that I don't doubt that many of these "separate" profiles have been aggregated. Unfortunately the services that supposedly offer to have your personal data removed from data brokers don't seem to support aliasing, so no straightforward way to either find out or have the data removed. [0] Just look at the scary list of third-party cookies you can't opt out of on Coursera [1], for example: Match and combine data from other data sources 419 partners can use this feature Always Active Identify devices based on information transmitted automatically 546 partners can use this feature Always Active Link different devices 358 partners can use this feature Always Active Deliver and present advertising and content 582 partners can use this special purpose Always Active [1] https://www.coursera.org/about/cookies-manage https://www.coursera.org/about/cookies-manage
- IanCal 11mo ago
  > [0] Just look at the scary list of third-party cookies you can't opt out of on Coursera [1], I can opt out of all of them. The only third party cookie I can't is a cloudfront one for crsf.
  - scoot 11mo ago
    They've changed their cookie consent provider (or rolled their own) since my comment. Probably just a happy coincidence, but well done Coursera in any case for fixing a pretty egregious breach of regulations. The other good news in the meantime is that the EU (who originally mandated cookie consent) has finally woken up to the ridiculousness of leaving it up to the site, and will require browsers to enforce it instead.
jwr 1y ago
> I used per-account email with alias services and password managers. For people who want to do this, be sure to get it right. I run a SaaS with a free tier, and I see people register with "fancy+nospam+servicename@gmail.com" addresses. Many of those become undeliverable or are left unread forever because of filtering rules. So when my system sends a warning E-mail that the account will be deleted due to inactivity, it doesn't get read, which leads to suboptimal outcomes for everyone involved.
- mapt 1y ago
  It was infuriating to me when normal_email+site_name@gmail.com stopped working for registration on some sites. Fucked up my Costco registration, a variety of other things. This sort of quasi-pseudonymity is required for basic security/privacy in 2025; It's the only way to get a handle on who's allowed to send you email, since we've never bothered to fix spoofing or impose a cost on spam. I've been trying to use it since Sneakemail was a free service back in the pre-Gmail days.
  - thallium205 1y ago
    Many spammers will strip the +xxxx out of the emails anyway to not reveal the source of their data so it doesn't matter too much really.
toddmerrill 1y ago
I do this also. I started doing it with physical mail before email existed to sort out the junk mail, so first and last name always contained a reference to the company you were dealing with. Paul Allen back in the 80s said in a Seattle Times interview that it was how he handled it.
6c696e7578 1y ago
> I used per-account email with alias services and password managers. 20-something-ish years ago I setup qmail in my VPS and a .qmail-default file captures all my me-sitename@vps emails. If they send me junk I echo '#' > .qmail-sitename and that's the end of it. Other things that get a mixture like someone annoying who harvested my ebay/paypal addresses or something, I'll sift out the good (stuff I need) via maildrop and everything else gets junked. Honestly one of the best, but annoying, things I've done, well worth the time invested as I have a nice clean mailbox.
- tguvot 1y ago
  did exactly same. the only difference is that i use compromised emails to train spam filter

lelandfe 1y ago

(the keyboard smash username is apropos) > Per-account alias might sound much Not only does this not sound too much, this is a feature Apple offers called Hide My Email: https://support.apple.com/en-us/102548 https://support.apple.com/en-us/102548

fainpul 1y ago
And one day you've had it with Apple's latest user-hostile shenanigans and switch to Linux. What now? Do you just keep paying for iCloud+ forever?
- marliechiller 1y ago
  wouldnt this be the case for any vendor you choose?
  - fainpul 1y ago
    yes
  - vladvasiliu 1y ago
    Indeed. But some are easier to change than others. I switched my e-mail provider, and it took all of five minutes to launch the copy of my data. Since I kept the same domain, everyone sending me e-mails didn't notice anything. With Apple's approach, I'd have to go through each account and move it from something@icloud to something@new-domain. However, for people who don't want to mess around with custom domain names and e-mail providers, apple's approach is very practical. You just need to tell it to "hide your email" when you register somewhere and you're good to go.
- steelframe 1y ago
  In my experience the overwhelming majority of services permit me to change my email address.
  - fainpul 1y ago
    Of course. But I have hundreds of user accounts, as probably many people do. I would not enjoy changing all those email addresses.
sometimes_all 1y ago
As someone who uses both, I much rather prefer aliases to hide-my-email for the more important stuff. For one, I can choose the email address "username", which I cannot with Apple's solution. Plus, what happens when I move on from Apple to something else?
- bn-usd-mistake 1y ago
  But aliases can be easily mapped back to your normal email address, unlike Apple's which are opaque. I, too, am afraid of vendor lock-in though. Sadly, couldn't find a good alternative yet
  - sometimes_all 1y ago
    Not sure where you're coming from - my original email address is not being shown in headers, so those seem fairly opaque. Probably depends on your email provider?
  - ziml77 1y ago
    There's no solution to lock-in because there must be some massively shared domain that the email address exists on for the anonymity of the service to properly work. However if you are simply looking for an alternative to Apple, Fastmail offers a masked email service too.

ekropotin 1y ago

I just use <myname>+<service>@gmail.com At the end of day day it’s all delivered to myname@gmail.com mailbox, but I can use filters based on part after “+”.

sneak 1y ago
As someone who deals in breach data this is a simple regex to strip out.
- mesrik 1y ago
  >As someone who deals in breach data this is a simple regex to strip out. Sure it is, but at least you do get later, post leak, a slight chance find out where leak originated. Data stealers seldom strip out that +extension part before the selling or otherwise dump it somewhere. And while it's passed on, you get to see address as you gave to that party that had leak. Reason seller don't strip of it is perhaps because they sell by number of unique addresses and while +extension usage is quite rare they make more money when they don't strip it off too. Information where it leaked can be very useful information to pass leaker at least up till point they have announced they know about the compromise happened. I've done that since turn of century too many times I've lost count already and been quite many times the first to get them know that they had a problem there. And sure I've received thank you emails that I gave them early head-up info about the issue.
tapland 1y ago
Anyone who’s looked at breach data knows to try yourname+service for any service. This does help in filtering spam though
- selcuka 1y ago
  It doesn't have to be literally the service name. Can be any unique alphanumeric suffix you make up randomly. As long as you use a password manager you don't have to remember it.
  - 1y ago

sometimes_all 1y ago

I also use per-account emails, but not sieve filtering. Catch-all is helpful for throw-aways, aliases for the more important stuff. It's super-easy to figure out who leaks my emails to whom, so I can easily disable both the leaker and the people who leaked. Much more user-friendly than Apple's hide-my-email.

scoot 1y ago

> I used per-account email [addresses] with alias services I do too (anything@mysubdomain.example.com), but but online services collude with data brokers to share so much information [0] that I don't doubt that many of these "separate" profiles have been aggregated. Unfortunately the services that supposedly offer to have your personal data removed from data brokers don't seem to support aliasing, so no straightforward way to either find out or have the data removed. [0] Just look at the scary list of third-party cookies you can't opt out of on Coursera [1], for example: Match and combine data from other data sources 419 partners can use this feature Always Active Identify devices based on information transmitted automatically 546 partners can use this feature Always Active Link different devices 358 partners can use this feature Always Active Deliver and present advertising and content 582 partners can use this special purpose Always Active [1] https://www.coursera.org/about/cookies-manage https://www.coursera.org/about/cookies-manage

IanCal 11mo ago
> [0] Just look at the scary list of third-party cookies you can't opt out of on Coursera [1], I can opt out of all of them. The only third party cookie I can't is a cloudfront one for crsf.
- scoot 11mo ago
  They've changed their cookie consent provider (or rolled their own) since my comment. Probably just a happy coincidence, but well done Coursera in any case for fixing a pretty egregious breach of regulations. The other good news in the meantime is that the EU (who originally mandated cookie consent) has finally woken up to the ridiculousness of leaving it up to the site, and will require browsers to enforce it instead.

jwr 1y ago

> I used per-account email with alias services and password managers. For people who want to do this, be sure to get it right. I run a SaaS with a free tier, and I see people register with "fancy+nospam+servicename@gmail.com" addresses. Many of those become undeliverable or are left unread forever because of filtering rules. So when my system sends a warning E-mail that the account will be deleted due to inactivity, it doesn't get read, which leads to suboptimal outcomes for everyone involved.

mapt 1y ago
It was infuriating to me when normal_email+site_name@gmail.com stopped working for registration on some sites. Fucked up my Costco registration, a variety of other things. This sort of quasi-pseudonymity is required for basic security/privacy in 2025; It's the only way to get a handle on who's allowed to send you email, since we've never bothered to fix spoofing or impose a cost on spam. I've been trying to use it since Sneakemail was a free service back in the pre-Gmail days.
- thallium205 1y ago
  Many spammers will strip the +xxxx out of the emails anyway to not reveal the source of their data so it doesn't matter too much really.

toddmerrill 1y ago

I do this also. I started doing it with physical mail before email existed to sort out the junk mail, so first and last name always contained a reference to the company you were dealing with. Paul Allen back in the 80s said in a Seattle Times interview that it was how he handled it.

6c696e7578 1y ago

> I used per-account email with alias services and password managers. 20-something-ish years ago I setup qmail in my VPS and a .qmail-default file captures all my me-sitename@vps emails. If they send me junk I echo '#' > .qmail-sitename and that's the end of it. Other things that get a mixture like someone annoying who harvested my ebay/paypal addresses or something, I'll sift out the good (stuff I need) via maildrop and everything else gets junked. Honestly one of the best, but annoying, things I've done, well worth the time invested as I have a nice clean mailbox.

tguvot 1y ago
did exactly same. the only difference is that i use compromised emails to train spam filter