Perhaps I could have saved even more than 15% if I'd just gone with it. :D
Unfortunately, many sites borked their e-mail address validation and do not accept the plus character. (Amazon permits it.) Also, you'll ocassionally find a customer service ticketing system that expects replies to come "From" your account's e-mail address. (Many mail clients can alter that header, but it's a pain.)
(Satisfied Panix customer.)
Not that I trust the "security questions", but if Amazon lets you use freeform questions as well as answers, it might help to make your first security question "Have you noticed this account has two factor authentication turned on?" with an answer like "Yes, so Amazon Customer Service will take additional care when being asked to reveal account information, right?"
Even if you can't do freeform questions, perhaps the answer to "What's your mother's maiden name?" could be something like "Have you noticed this account has two factor authentication turned on? Please take extra care before disclosing account details to anyone, Thanks."
Remember it's a human verifying this. The attacker just needs to answer: "oh, yeah i just spammed the keyboard with some jibberish" and he's in.
The other thing I noticed by the attacker going after me, sometimes he'd call/contact the service multiple times in a row. All he needs to do is find out from 1 support rep that the reset password is randomly generated. Then tell another support rep that its "some jibberish" and he's in.
What's your favourite football team? -> Genghis Khan 2nd XI What was your first school called? -> Little Horrors School for Hackers
etc. Easier to say, you won't lose the customer service rep's attention either :)
Twice now I was only able to register after removing the +[something] part of the email.
Is + actually an invalid email character (according to RFCs etc?). I couldn't find any reference to that when I looked.
RFC 821 is the original and 2821 summarizes it plus the few that came after to add and clarify.
The only true "RFC email validity check" is to send an email to whatever address they provide.
An intermediate step that may work if you don't expect people to target you individually: have one or more required substrings for the email local part, and catch all mail to addresses containing that substring.
Are you saying that there are sites out there which don't accept [email protected] a valid email address? If so, that's beyond broken...
Sorry, could you repeat that? [email protected] certainly matches \.edu$.
Unless you're worried about the false-positive for a non-student with a different subdomain?
Only one university in Germany has a .edu, and their students obviously manage to get far more benefits than those of us with an @informatik.uni-kiel.de email.
In Brazil, universities can use .edu.br, but we have few universities providing email addresses to students and also, the majority of grad schools in Brazil are not universities but a small college called 'University Center'
I'll note that I don't use this method as it seems too high maintenance and the effectiveness is unclear.
Hasn't been a problem for me.
I haven't found this to be true, or at least Google's spam filters have gotten sufficiently good to prevent it.
I have a catch-all address @morgante.net and rarely ever see spam—maybe once a week.
I used to do this too and it was great, but then when I started trying to recover accounts that were a few years old, I had a heck of a time remembering what email address I had actually given them in the first place!
aws vs amazon-web-services vs amazon.web.services
facebook vs fb vs fbook
Or for example I've used Rally the project management tool but my health insurance uses a (terrible) "rewards" program called "werally" but it's ALWAYS referred to "rally". It can get unmanageable.
Now I use 1Password to track all of this stuff which works well so I think there are solution but I do understand the grand-OPs point.
It's ignored for delivery, but gmail's filters can match on it in the to: address.
What you may want is a catch-all email - which lets you do @domain.com -> [email protected] (where is everything besides already defined addresses) - that way you can make up emails on the fly without having to setup the alias beforehand.
I've had that setup for 5 or 6 years now, and it works extremely well. A handy side-effect of this is it makes it easy to see which companies sell your email address to spammers when you included the name of the original company in the email you register with