7 ms·
> Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legit
by petcat 7mo ago
> Like all good nerds, I generate a unique email address for every service I sign up to. This has several advantages - it allows me to see if a message is legitimately from a service, if a service is hacked the hackers can't go credential stuffing, and I instantly know who leaked my address.
I think a lot of services will "de-alias" the email addresses from these tricks to prevent alts, account spam, and to still target the "real" account holder email. So the old tricks like "<name>+<website>@<host.com>" is not considered a unique email from "<name>@<host.com>". Unless your site-specific emails are completely new inbox aliases, then I don't think this is as effective as people think it is anymore.
- gruez 7mo ago> So unless your site-specific emails are completely new inbox aliases, then I don't think this is as effective as people think it is anymore. Even if it's a "new" alias, I often see people[1] using simple schemes to derive the address, eg. facebook@mydomain.example. With cheap LLMs it's not hard to automatically guess what the underlying pattern is. edit: [1] ie. in this very thread
- Jaxan 7mo agoI just do <website>@<myhost.tld>. It is sometimes confusing by when interacting with customer support ;-)
- OptionOfT 7mo agoYes ma'am, my email address really is bofa.com@<optionoft's-lastname>.com No I'm not trying to hack you. Which in hindsight is also what a hacker would say. I can't win...
- noAnswer 7mo agoThere are some big brain companies who will block you if their name appears in the email address. Like Discord. You can create an account, with discrod@example.com. But a seconde later you will get an email that your account got band. They know their way around IT security! /s
- anonymousiam 7mo agoWhat you say is often true, but in the case of Discord, at least in my case, you are wrong. My Discord email address is discord@xxx.com, and I am still receiving emails from them.
- noAnswer 7mo agoIt happend to me when i created my account in 2025. Within seconds of verifying the address I got a email that my account was band for TOS violation. I than created a seconds account (within minutes from the same IP) only writing "dc" instead of "discord" and that worked. ¯\_(ツ)_/¯
- anonymousiam 7mo agoApparently they (unlike other entities I've dealt with) did not go back and review all of the existing, valid email addresses in their user database. It's always an unpleasant surprise when some company terminates a years-old, active and valid account because of a stupid policy change on their part.
- zephen 7mo agoWhere, of course, 'bofa' is merely short for 'bofetada.'
- jnettome 7mo agoOn top of it my email address is .me so is very common to when I finish spelling my e-mail, people waiting for .com
- phyzome 7mo agoI often get asked whether I'm a fellow employee.
- Semaphor 7mo agoI had one website forward my mail to their legal department who asked me why I’m impersonating them :D Only required a short explanation though.
- Kab1r 7mo agoI've had this a couple times too
- theandrewbailey 7mo agoI have an account just like that at Best Buy with my domain. The teenage cashier I gave it to thought it was cool.
- nick-sta 7mo agoI personally do x@mydomain.com. It makes it very obvious when you start getting spam (I’m looking at you dji).
- overlordalex 7mo agoThe way that this is done these days (and likely what the author did/does) is that you use a custom domain to receive mail; you provide an email like service@custom.com, and that way when service@ starts receiving spam you know exactly where it comes from
- ValentineC 7mo ago^ I've been doing this with catchalls since before Google Apps for Domain was even a thing. Sometimes customer support staff bring up "oh, do you work at <company> too"? I just tell them that I created an email address just for their company, in case they spam me.
- anonymousiam 7mo agoI've got a few dozen domains, and primarily use two of them for business interactions. One is a catchall, while the other requires me to create explicit email addresses (or aliases). Aside from issues such as the business entity (sometimes silently) prohibiting their name in my email address, I have sometimes encountered cases where part of the email validation process checks to see if the email server is a catchall, and rejects the email address if it is. It takes a little extra effort on my part to make a new alias, but sometimes it's required. Lots of organizations (such as PoS system providers) will associate an email I provided with credit card number, and when I use the card at a completely different place, they'll automatically populate my email with the (totally unrelated) one that they have. Same goes for telephone numbers. I've had many incidents similar to the author. More often than not, it's a rouge employee or a compromised computer, but sometimes it is as nefarious as the author's story.
- fmajid 7mo agoWildcard email addresses will subject you to a torrent of spam when spammers try dictionary attacks against your domain. It's better to explicitly create aliases, I built a web UI for Postfix to do this for myself and family (https://GitHub.com/fazalmajid/postmapweb https://GitHub.com/fazalmajid/postmapweb)
- QuantumNomad_ 7mo agoiCloud has a great feature that allows you to generate unique aliases on the fly quickly and easily. For example when signing up for new services via the web browser on iOS, you can generate a new address with the click of a button. Many years ago, before I started using iCloud Mail, I was running my own email server and had it set up to forward everything sent to any address on my domain to my inbox. The advantage was that I could invent random aliases any time I wanted and didn’t even need to do anything on the server for those emails to get delivered to my main inbox. The very big drawback as I soon experienced was that spammers would email a lot of different email addresses on my domain that never existed but because I was going catch-all, would also get delivered to my main inbox. They’d be all kinds of email addresses like joe@ or sales@ or what have you. So apparently they were guessing common addresses and because I was accepting everything I’d also get tons of spam.
- sdevonoes 7mo agoThe downside of such iCloud aliases is that you cannot send emails from there (you can only reply to emails, and ofc receive emails)
- QuantumNomad_ 7mo agoTrue, and there has been a time or two where that has been inconvenient for me as well. Initial account creation confirmation email, and maybe even some newsletters, were sent from noreply@ some domain. Responding to such an email address directly will likely either bounce or be silently dropped on their side, as indicated by them using noreply as the sender address. The website might say to email support@ their domain. But because like you point out iCloud alias addresses cannot be used as sender when composing a new message, and I don’t have any past received emails from that address, I can’t email them using the same alias email address that I used to create an account. And of course if the account belongs to jumping.carrot-1j@icloud.com and I instead send an email to them from a different sender address, then they will be sceptical about whether it really is the account owner trying to get in touch or some impostor. Assuming they don’t completely ignore the email on that grounds, you might eventually get support if you are able to either answer questions from them about past invoice amounts and dates or similar, or if they are willing to email the original account owner address from their support address. But it’s extra hassle, if they even bother to respond at all. Fortunately most websites have a contact form or similar to get in touch with their support, but there are a few sites that have an email address as the only way to contact their support.
- mjlee 7mo agoI use Fastmail with my own domain and 1Password. Together they give me a “masked email” button for forms that generates a random enough email address (two common words and four digits) and records the domain it was for. You can also create them ad-hoc from Fastmail’s interface. As well as simply attributing leaks, it’s most valuable as a phishing filter. Why would my bank ever email an address I only used to trial dog food delivery?
- garciansmith 7mo agoYeah, Fastmail's aliases are great. I used to do things described by some other commenters, like myemail+nameofservice@ and whatnot, but this way the email is automatically generated and you don't have to put any thought into it.
- deleted 7mo ago[deleted]
- tvbusy 7mo agoI use DuckDuckGo Email and it generates unique addresses that I can both receive emails (obviously) and reply to from that email. There's also an option to shutdown that address and never receive spam again.
- fg137 7mo agoOf course. I use Firefox Relay to generate a unique email address for every site where I have to use an email. That method hasn't failed me so far.