I hadn't heard of the canary account approach. Nice idea!

As for single-purpose email addresses, that only works for cases where the service isn't selling account information, correct?

>As for single-purpose email addresses, that only works for cases where the service isn't selling account information, correct?

I don't know how you would tell the difference in that case so I assume yes.

The way I implement this is I bought an entire domain for spam. I created a catchall account and when I sign up for services I can just punch in [email protected] for example. All of this filters into a single email account allowing me to retrieve all my password resets and account confirmations.

This will weird out some people over the phone:

"Yes, it's [email protected]"

"Sir, to look up your account I need YOUR email address"

I do something very similar. I've had a hotel clerk ask me if I worked for them when I told them my name was <hotelchain>@<mydomain>.org

You can also do this with Gmail aliases[0]: "For example, messages sent to [email protected] are delivered to [email protected]." Although the number of sites with incorrect email validation (that reject perfectly valid email addresses) is shocking. I do this, and you can then just block the alias if it starts recieving spam.

[0] https://support.google.com/mail/answer/12096?hl=en

With fastmail you can also use subdomain addressing [0] for those broken sites and to prevent people from filtering (\+[^@]+) to get unmarked addresses. [email protected] is handled the same way as [email protected]

[0] https://www.fastmail.com/help/receive/addressing.html

While it may have worked in the past (for a while anyway), what exactly prevents spammers from stripping the suffix, given that the functionality has been public knowledge for many years? Best case they'll be lazy and try both with and without, and you'll end up knowing. Blocking the alias cannot possibly have any effect.

> Blocking the alias cannot possibly have any effect.

Ah, but it does work (for me, twice). Of course spammers could strip the suffix. But since spam is a numbers game, I'm not sure it's worth the effort for them.