6 ms·

Reading that thread was painful. I always use custom one-off email addresses for services I sign-up for and. When I've attempted to report disclosure of my emai

Reading that thread was painful. I always use custom one-off email addresses for services I sign-up for and. When I've attempted to report disclosure of my email address I'm almost always met with major skepticism. It's maddening. I used to enjoy the reactions I'd get from store clerks and telephone reps when I give them my email address. "Oh, how you have an email address with our company name in it?" In recent years the reactions have turned kinda hostile, "What is your connection with our company?" and once "You can't have our company name in your email address." I gave up fighting and now I just use random strings.

nwh 14y ago
I recently had to sit through a customer rep read a 32 character long alphanumspecial email address out to me for "security reasons". Bet she was glad I didn't use usicode.
- saraid216 14y ago
  You might consider just picking one or two random words from the dictionary.
  - signed0 14y ago
    That sounds like a fun idea for an app/service. You provide it with your base email address or custom domain and it generates a couple random words and keeps track of what service you used it to sign up for.
    - GhotiFish 14y ago
      I spent a little time thinking about this concept and how it relates to just having dummy account you control, for giving to services you don't fully trust. As long as you use a secure password, and you don't use the same one. I don't see alot of difference, but the ability to sandbox each service to a list of email accounts, so that the attacker never knows the master account, would be an extra layer of security. Utility exists here. I just don't think there's enough utility to justify the work.
      - signed0 14y ago
        A better option might be integrating it into LastPass or 1Password. They already generate a random password for you, why not an email address as well?
      - nwh 14y ago
        I use something similar already. I've a domain that is used purely for my email. Normal addresses like webmaster@ are rejected. A script on the server takes the domain I am registering for a service on (eg "google.com"), generates an random-looking but deterministic address, and creates an alias for that address to my real inbox. End result is that everyone gets a unique email that can't be guessed, I can nuke an address as soon as it starts sending me spam (often) and my true inbox is typically completely clean. I initially made the mistake of trusting my bank and utility billing systems with my real address. Turns out my power company had their database compromised, and when I called to inform them they refused to believe me (like Dropbox).
        LancerSykera 14y ago
        A good five years ago I got two phishing emails to two unique addresses that I had used to contact a local bank. They also refused to believe me, and it was basically my fault for not securing my computer. Somehow.
        nwh 14y ago
        Well that's terrifying.
danielweber 14y ago
Acme Inc's employees being suspicious of people with "acme" in their email address is probably, on the whole, a good thing. It smells like a phishing scam to people who don't know about throwaways.
bdc 14y ago
It is actually possible that you violate their tos by doing so - it could be construed as falsely implying some representation of the company. A stretch to any sane person, though any typical terms document contains miles and miles of cya.
bsimpson 14y ago
I just tell them it makes it easier for me to find their e-mails.
neogodless 14y ago
Wow. That sounded a lot like I wrote it. Sounds like the same story line I've experienced. :) If I'm at Toys R Us or something, I'll just be like uh... "tru25@<mydomain>.com" so they don't question me. (Also, I chose Toys R Us as an example because when I went to sign up for a loyalty program, and they typed in "toysrus@<mydomain>.com" their cash register black screened and rebooted... !)
Shorel 14y ago
That's what rot13 was created for. dropbox email -> qebcobk@yourdomain.com
deleted 14y ago
[deleted]

nwh 14y ago

I recently had to sit through a customer rep read a 32 character long alphanumspecial email address out to me for "security reasons". Bet she was glad I didn't use usicode.

saraid216 14y ago
You might consider just picking one or two random words from the dictionary.
- signed0 14y ago
  That sounds like a fun idea for an app/service. You provide it with your base email address or custom domain and it generates a couple random words and keeps track of what service you used it to sign up for.
  - GhotiFish 14y ago
    I spent a little time thinking about this concept and how it relates to just having dummy account you control, for giving to services you don't fully trust. As long as you use a secure password, and you don't use the same one. I don't see alot of difference, but the ability to sandbox each service to a list of email accounts, so that the attacker never knows the master account, would be an extra layer of security. Utility exists here. I just don't think there's enough utility to justify the work.
    - signed0 14y ago
      A better option might be integrating it into LastPass or 1Password. They already generate a random password for you, why not an email address as well?
    - nwh 14y ago
      I use something similar already. I've a domain that is used purely for my email. Normal addresses like webmaster@ are rejected. A script on the server takes the domain I am registering for a service on (eg "google.com"), generates an random-looking but deterministic address, and creates an alias for that address to my real inbox. End result is that everyone gets a unique email that can't be guessed, I can nuke an address as soon as it starts sending me spam (often) and my true inbox is typically completely clean. I initially made the mistake of trusting my bank and utility billing systems with my real address. Turns out my power company had their database compromised, and when I called to inform them they refused to believe me (like Dropbox).
      - LancerSykera 14y ago
        A good five years ago I got two phishing emails to two unique addresses that I had used to contact a local bank. They also refused to believe me, and it was basically my fault for not securing my computer. Somehow.
        nwh 14y ago
        Well that's terrifying.

danielweber 14y ago

Acme Inc's employees being suspicious of people with "acme" in their email address is probably, on the whole, a good thing. It smells like a phishing scam to people who don't know about throwaways.

bdc 14y ago

It is actually possible that you violate their tos by doing so - it could be construed as falsely implying some representation of the company. A stretch to any sane person, though any typical terms document contains miles and miles of cya.

bsimpson 14y ago

I just tell them it makes it easier for me to find their e-mails.

neogodless 14y ago

Wow. That sounded a lot like I wrote it. Sounds like the same story line I've experienced. :) If I'm at Toys R Us or something, I'll just be like uh... "tru25@<mydomain>.com" so they don't question me. (Also, I chose Toys R Us as an example because when I went to sign up for a loyalty program, and they typed in "toysrus@<mydomain>.com" their cash register black screened and rebooted... !)

Shorel 14y ago

That's what rot13 was created for. dropbox email -> qebcobk@yourdomain.com

deleted 14y ago

[deleted]