9 ms·

The way some people do "fredsmith+amazon@gmail.com" as proof that it must be amazon that leaks their passwords has some issues. The guy who says that he had a

The way some people do "fredsmith+amazon@gmail.com" as proof that it must be amazon that leaks their passwords has some issues. The guy who says that he had a truly random bunch of letters as his dropbox account is probably a better indicator, but it's hard to know if the guy ever leaked it himself. Doesn't excuse the moderators being jerks, though.

Mahn 14y ago
Speaking of which, this alias system from google is great in theory, but kind of pointless in practice; spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias.
- yid 14y ago
  It's not from Google; it's called subaddressing: http://en.wikipedia.org/wiki/Email_address#Address_tags http://en.wikipedia.org/wiki/Email_address#Address_tags
- jaibot 14y ago
  It's pointless in practice in theory; in practice in practice spammers (in my experience) don't target + aliases. And if you think about the set of people who are likely to give money to spammers, the set of people using + aliases, and the fraction of + alias space that is occupied versus the fraction of non-+'aliased space that is occupied, the reason why becomes clear.
  - pfranz 14y ago
    I've tried to use this system in the past, but found it to be a PITA. A lot of email systems won't let you use a +. The other gotcha I get is that they use the email address as a login token (Dropbox, for example). So you have to remember a) that you used a token and b) what it was. Any suggestions on approaching these?
    - chmars 14y ago
      I use domaincom@mydomain.com, e.g., dropboxcom@mydomain.com.
    - bigiain 14y ago
      1Password (or equivalent). Even though a service might desperately want to know my personal and/or business email address, and disguise that desire with the usual "Hey, just use your email address as your login username!", doesn't mean I have to comply. Unless they're prepared to accept responsibility to disclosure of my address, I feel perfectly happy taking the required measures to minimise those risks myself - no matter what they attempt to enforce with crappy email validation or ToS requirements. (And, although Dropbox have finally arrived in their forum-thread ~24hrs late apologising for their "community moderators" calling their customers idiots, the responses from Nathan and especially Chris only strengthen my resolve to ignore any attempt by companies/services to gain access to my personal email addresses as part of their user databases.)
    - __david__ 14y ago
      I always use the domain-name minus the top level for my token. So if my base email were "david@example.com", for "dropbox.com" it would be david+dropbox@example.com. That makes it very easy to figure out all the emails I might have (since I'm essentially just remembering an very simple algorithm to generate them). Very often sites have sucky email validation that rejects "+" so I configured my system to allow . and _ to also work the same way. That way I can choose david.dropbox@example.com or david_dropbox@example.com if the + doesn't work.
    - itsybitsycoder 14y ago
      I once ran into the problem where a retail site forced me to sign up before paying, then refused to accept Paypal payment from any address except the one I signed up with. Of course my Paypal wasn't myemail+retailsite@gmail.com. Very annoying.
- greenmountin 14y ago
  That's true for a negative filter, but not a positive one; although, an email that required the subaddress might be less universal.
- rhizome 14y ago
  spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias. Do they in fact do this?
  - numbsafari 14y ago
    Yep. I know for a fact they do. Yahoo! Plus has a much better system where you use a different base email address plus the sub-address rather than your regular address. For example, if my account is "somebody@gmail.com" then you use somebody+dropbox@gmail.com. But with yahoo, you pick an alternate, e.g. "huggybear", and use that instead (huggybear-dropbox@yahoo.com). That way if a spammer seems the sub-addressed account, they can't send email to huggybear@yahoo.com unless they want to end up on Yahoo's blacklist. I've had a great deal more success with Yahoo's sub-addressing than Google's.
    - Mahn 14y ago
      That's perfect, I wish you could do something like this in gmail without specifically creating a new account for every alias.
      - numbsafari 14y ago
        I should clarify: with Yahoo plus you only create one base for all your sub-addresses, not a new base for every sub-address. So in my earlier example, if you wanted to sub-address ebay, amazon and hackernews you'd have huggybear-ebay@, huggybear-amazon@ and huggybear-hn@. The big deal is that huggybear@ != someone@ and sending to huggybear@ won't reach someone@ and likely earns you a place on their blacklist (or some points towards ending up there).
ubercow13 14y ago
Some of the posters seem to be saying they have received spam on a single, dropbox-specific address on their own domains, though, presumably with catch-all email, so that an attacker wouldn't just have had to guess fredsmith.dropbox@fredsmith.com, but also not tried a single other address @fredsmith.com
tokenadult 14y ago
When I try subaddressing as I try to sign up for new online services, more often than not that address format is rejected as invalid. Most online services don't have very good email validation.
- jey 14y ago
  Use a whole domain name, e.g. signup for dropbox with dropbox@tokenadult.com. You could do this with Google Apps Gmail by setting a catch-all forwarding address for the domain.
  - eli 14y ago
    It's all fun and games until you get attacked by a spambot that tries blindly sending thousands of messages to <common_user_names>@yourdomain.com
    - agwa 14y ago
      I use a sub-domain (e.g. @m.mydomain.com) for my catch-all and this hasn't happened to me. There are various easy ways for spammers to find out about domains, but sub-domains can remain relatively obscure.
      - Terretta 14y ago
        Hey, that's sharp.
      - EwanToo 14y ago
        Oh that's a nice trick, I might give that a go - thanks!
    - pepr 14y ago
      I have a setup like that, I get more spam because of that of course but Google is really good at filtering it. And especially in conjunction with priority inbox, it's a breeze (and very convenient).
    - 14y ago

Mahn 14y ago

Speaking of which, this alias system from google is great in theory, but kind of pointless in practice; spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias.

yid 14y ago
It's not from Google; it's called subaddressing: http://en.wikipedia.org/wiki/Email_address#Address_tags http://en.wikipedia.org/wiki/Email_address#Address_tags
jaibot 14y ago
It's pointless in practice in theory; in practice in practice spammers (in my experience) don't target + aliases. And if you think about the set of people who are likely to give money to spammers, the set of people using + aliases, and the fraction of + alias space that is occupied versus the fraction of non-+'aliased space that is occupied, the reason why becomes clear.
- pfranz 14y ago
  I've tried to use this system in the past, but found it to be a PITA. A lot of email systems won't let you use a +. The other gotcha I get is that they use the email address as a login token (Dropbox, for example). So you have to remember a) that you used a token and b) what it was. Any suggestions on approaching these?
  - chmars 14y ago
    I use domaincom@mydomain.com, e.g., dropboxcom@mydomain.com.
  - bigiain 14y ago
    1Password (or equivalent). Even though a service might desperately want to know my personal and/or business email address, and disguise that desire with the usual "Hey, just use your email address as your login username!", doesn't mean I have to comply. Unless they're prepared to accept responsibility to disclosure of my address, I feel perfectly happy taking the required measures to minimise those risks myself - no matter what they attempt to enforce with crappy email validation or ToS requirements. (And, although Dropbox have finally arrived in their forum-thread ~24hrs late apologising for their "community moderators" calling their customers idiots, the responses from Nathan and especially Chris only strengthen my resolve to ignore any attempt by companies/services to gain access to my personal email addresses as part of their user databases.)
  - __david__ 14y ago
    I always use the domain-name minus the top level for my token. So if my base email were "david@example.com", for "dropbox.com" it would be david+dropbox@example.com. That makes it very easy to figure out all the emails I might have (since I'm essentially just remembering an very simple algorithm to generate them). Very often sites have sucky email validation that rejects "+" so I configured my system to allow . and _ to also work the same way. That way I can choose david.dropbox@example.com or david_dropbox@example.com if the + doesn't work.
  - itsybitsycoder 14y ago
    I once ran into the problem where a retail site forced me to sign up before paying, then refused to accept Paypal payment from any address except the one I signed up with. Of course my Paypal wasn't myemail+retailsite@gmail.com. Very annoying.
greenmountin 14y ago
That's true for a negative filter, but not a positive one; although, an email that required the subaddress might be less universal.
rhizome 14y ago
spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias. Do they in fact do this?
- numbsafari 14y ago
  Yep. I know for a fact they do. Yahoo! Plus has a much better system where you use a different base email address plus the sub-address rather than your regular address. For example, if my account is "somebody@gmail.com" then you use somebody+dropbox@gmail.com. But with yahoo, you pick an alternate, e.g. "huggybear", and use that instead (huggybear-dropbox@yahoo.com). That way if a spammer seems the sub-addressed account, they can't send email to huggybear@yahoo.com unless they want to end up on Yahoo's blacklist. I've had a great deal more success with Yahoo's sub-addressing than Google's.
  - Mahn 14y ago
    That's perfect, I wish you could do something like this in gmail without specifically creating a new account for every alias.
    - numbsafari 14y ago
      I should clarify: with Yahoo plus you only create one base for all your sub-addresses, not a new base for every sub-address. So in my earlier example, if you wanted to sub-address ebay, amazon and hackernews you'd have huggybear-ebay@, huggybear-amazon@ and huggybear-hn@. The big deal is that huggybear@ != someone@ and sending to huggybear@ won't reach someone@ and likely earns you a place on their blacklist (or some points towards ending up there).

ubercow13 14y ago

Some of the posters seem to be saying they have received spam on a single, dropbox-specific address on their own domains, though, presumably with catch-all email, so that an attacker wouldn't just have had to guess fredsmith.dropbox@fredsmith.com, but also not tried a single other address @fredsmith.com

tokenadult 14y ago

When I try subaddressing as I try to sign up for new online services, more often than not that address format is rejected as invalid. Most online services don't have very good email validation.

jey 14y ago
Use a whole domain name, e.g. signup for dropbox with dropbox@tokenadult.com. You could do this with Google Apps Gmail by setting a catch-all forwarding address for the domain.
- eli 14y ago
  It's all fun and games until you get attacked by a spambot that tries blindly sending thousands of messages to <common_user_names>@yourdomain.com
  - agwa 14y ago
    I use a sub-domain (e.g. @m.mydomain.com) for my catch-all and this hasn't happened to me. There are various easy ways for spammers to find out about domains, but sub-domains can remain relatively obscure.
    - Terretta 14y ago
      Hey, that's sharp.
    - EwanToo 14y ago
      Oh that's a nice trick, I might give that a go - thanks!
  - pepr 14y ago
    I have a setup like that, I get more spam because of that of course but Google is really good at filtering it. And especially in conjunction with priority inbox, it's a breeze (and very convenient).
  - 14y ago