4 ms·

> as {their company name}@mydomain.com People are still doing that? To prevent spam? To "catch" the company leaking/selling your address? Now the spammers know

by kgwxd 4mo ago

> as {their company name}@mydomain.com People are still doing that? To prevent spam? To "catch" the company leaking/selling your address? Now the spammers know they can likely use anything@domain, and it'll get to your eyeballs in some capacity. Also, companies have no shame anymore, they don't care if you know.

volemo 4mo ago
But the portion of us is so negligible that it’s not worth for the spammers to handle our edge case. :D
deleted 4mo ago
[deleted]
scottmcmac 4mo ago
Yeah, I do the same, but without the catchall for exactly that reason. If I start getting spam, the e-mail gets disabled.
- picofarad 4mo ago
  Smart, what server / service do you use?
  - eks391 4mo ago
    Look up email alias service or something similar, if you aren't looking to self host. I can't recommend the service I use, because I'm grandfathered in to my plan, and their current plans for new customers suck, but there's enough providers out there that you should find something competitive. If you want to 'self host' on a provider, I thing cheap/free options are available from cloudflare, Google, and similar enterprise companies. If you want to truly self host, I don't have experience, but this guy who does gave a great thorough answer for those who are interested: https://news.ycombinator.com/item?id=48073510 https://news.ycombinator.com/item?id=48073510
    - genewitch 4mo ago
      I'm paying $15/yr currently for a catchall, plus the domain. I think new customers get charged $50+ a year, maybe even closer to $100.
kurttheviking 4mo ago
I do but mostly for coordination and comms sharing with my spouse by using group aliases. Summer camp registration, school nurse contact info, car insurance, library holds...all super convenient to get joint notifications for things. And yeah, also to remember who we gave contact info to which we can drop if it gets spammy.
greengreengrass 4mo ago
I started doing it when so many sites had broken + aliasing stuff, which I use for filing mail to keep my inbox manageable and actionable, as it was easier to type than my double-hyphen hack described above. I’m not concerned about the leaking as my address is out there anyway and Bayesian spam filtering is still decent enough, but as an aside, I have had two companies this year whose user databases must have been leaked on the basis of spam received at company-specific addresses. I reported it to their privacy people and pointed out it’s highly unlikely this “spam” originated as their (tiny company name) being chosen by chance by a spammer who figured out my catch all domain. They never replied, and I probably should have followed up with the local information regulatory commission in each case. Hopefully, my note helped them identify they had a leak and to secure their systems.
garaetjjte 4mo ago
In practice they don't do that, apart from spamming few addresses like office@ or accounting@. If some address starts getting spam I reject everything sent to it. For addresses that are getting spam but needs to be public (like contact addresses on website) I do more aggressive filtering (eg. I noticed that enforcing that recipient is actually present in To/Cc header cuts down a lot of spam).
dredmorbius 4mo ago
The practice also makes filtering more effective. Rather than whitelisting simply on a given sender, you can rely on both the sender and the recipient address matching a known list. This needn't be a single sender address. If you have multiple contacts at a domain, or a given entity relies on several email services (e.g., direct personal email, vendor-based marketing emails, vendor-based support or notification services), you could add all of these to the "from" match set. I'm thinking through phone comms presently and am considering a similar concept for mitigating ever-growing phone abuse. Running a VOIP/PBX system, having multiple internal, non-public "extensions", each of which is valid for only a small subset of caller numbers. The "extension" space could be large (6--9 digits, say, millons to billions of values), making exhaustive search / coincidental match infeasible. (This is only one of a few approaches I'm thinking of, it happens to resemble the specific email practice being discussed.)

by kgwxd 4mo ago

volemo 4mo ago

But the portion of us is so negligible that it’s not worth for the spammers to handle our edge case. :D

deleted 4mo ago

[deleted]

scottmcmac 4mo ago

Yeah, I do the same, but without the catchall for exactly that reason. If I start getting spam, the e-mail gets disabled.

picofarad 4mo ago
Smart, what server / service do you use?
- eks391 4mo ago
  Look up email alias service or something similar, if you aren't looking to self host. I can't recommend the service I use, because I'm grandfathered in to my plan, and their current plans for new customers suck, but there's enough providers out there that you should find something competitive. If you want to 'self host' on a provider, I thing cheap/free options are available from cloudflare, Google, and similar enterprise companies. If you want to truly self host, I don't have experience, but this guy who does gave a great thorough answer for those who are interested: https://news.ycombinator.com/item?id=48073510 https://news.ycombinator.com/item?id=48073510
  - genewitch 4mo ago
    I'm paying $15/yr currently for a catchall, plus the domain. I think new customers get charged $50+ a year, maybe even closer to $100.

kurttheviking 4mo ago

I do but mostly for coordination and comms sharing with my spouse by using group aliases. Summer camp registration, school nurse contact info, car insurance, library holds...all super convenient to get joint notifications for things. And yeah, also to remember who we gave contact info to which we can drop if it gets spammy.

greengreengrass 4mo ago

I started doing it when so many sites had broken + aliasing stuff, which I use for filing mail to keep my inbox manageable and actionable, as it was easier to type than my double-hyphen hack described above. I’m not concerned about the leaking as my address is out there anyway and Bayesian spam filtering is still decent enough, but as an aside, I have had two companies this year whose user databases must have been leaked on the basis of spam received at company-specific addresses. I reported it to their privacy people and pointed out it’s highly unlikely this “spam” originated as their (tiny company name) being chosen by chance by a spammer who figured out my catch all domain. They never replied, and I probably should have followed up with the local information regulatory commission in each case. Hopefully, my note helped them identify they had a leak and to secure their systems.

garaetjjte 4mo ago

In practice they don't do that, apart from spamming few addresses like office@ or accounting@. If some address starts getting spam I reject everything sent to it. For addresses that are getting spam but needs to be public (like contact addresses on website) I do more aggressive filtering (eg. I noticed that enforcing that recipient is actually present in To/Cc header cuts down a lot of spam).

dredmorbius 4mo ago

The practice also makes filtering more effective. Rather than whitelisting simply on a given sender, you can rely on both the sender and the recipient address matching a known list. This needn't be a single sender address. If you have multiple contacts at a domain, or a given entity relies on several email services (e.g., direct personal email, vendor-based marketing emails, vendor-based support or notification services), you could add all of these to the "from" match set. I'm thinking through phone comms presently and am considering a similar concept for mitigating ever-growing phone abuse. Running a VOIP/PBX system, having multiple internal, non-public "extensions", each of which is valid for only a small subset of caller numbers. The "extension" space could be large (6--9 digits, say, millons to billions of values), making exhaustive search / coincidental match infeasible. (This is only one of a few approaches I'm thinking of, it happens to resemble the specific email practice being discussed.)