News for hackers. Stuff that matters.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by rm_-rf_slash on Tuesday October 03, 2017 @05:25PM (#15396348)
I know a guy who uses a service that creates a unique email account for every service he signs up for. That way, he tells me, if he ever gets any spam, he can delete the account and it doesn't affect any of his other email accounts.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by throw_away on Tuesday October 03, 2017 @06:38PM (#15396808)
This can be done easily if you own a domain and use a service that lets you specify a catch-all address. I do this with my own domain and G Suite. Then, you don't even need to do any preparation before giving out the address.

It does sound weird to the person writing it down and I've had more than one person say something like "well, if you're just going to give me a fake address, then don't bother" before I explained myself.

One other down side is that it is not as easy to reply to mail as the other, generated identity (in gsuite, you need to create a new account in the domain to write as that username and also maybe jump through a hoop or two). Replying casually can often reveal your main identity, which is often the one you are trying to strongly protect.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by jsjohnst on Tuesday October 03, 2017 @09:14PM (#15397597)
Go into Gmail settings and add aliases there for each “account” you want to add to the catch-all. Actual separate accounts costs you $5+/month each.

(I do similar on my domains and the Gmail alias is easier to do than logging into Admin CP and adding aliases there)

Re:Yahoo Triples Estimate of Breached Accounts to 3B by postila on Tuesday October 03, 2017 @10:40PM (#15397913)
+1. I also use *@mydomain.com feature in G Suite, and it's very convenient to understand which companies sell/pass email databases to others w/o my permission. In some cases, you need to reply from that "aliased" address -- in this case, I do go to the Settings, add an alias, got a confirmation code, and confirm it. Then this new "address" is available in GMail in drop-down "From:" menu when you write a new email.

[email protected] is also a useful feature (as well as [email protected] – dots are all ignored in GMail; some services don't allow "+" in email address field, so you can use finite number of variants with ".").

These little tricks make GMail convenient for geeks :)

Re:Yahoo Triples Estimate of Breached Accounts to 3B by mixmastamyk on Tuesday October 03, 2017 @07:27PM (#15397096)
Thunderbird has the virtual identity plugin for this.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by mschuster91 on Tuesday October 03, 2017 @05:28PM (#15396361)
With gmail, you don't need it - [email protected] will end up as [email protected] and you can filter by To: header.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by odammit on Tuesday October 03, 2017 @05:40PM (#15396446)
I’ve run a fair amount of email campaigns where we strip out the + if gmail is the domain to ensure it doesn’t end up in some weird filter.

Dick move, I know. Tell marketing that though.

I personally use gmail through a vanity domain and have a catch all rule, so I end up signing up with a fake email account for every domain ([email protected]) and then the catch all forwards it to my real account ([email protected]).

Re:Yahoo Triples Estimate of Breached Accounts to 3B by JoshTriplett on Tuesday October 03, 2017 @05:52PM (#15396537)
> I’ve run a fair amount of email campaigns where we strip out the + if gmail is the domain to ensure it doesn’t end up in some weird filter.

At which point you should wind up in the "how widely can I advertise that you're a spammer and all your outbound email should all be routed straight to /dev/null for sending mail to an email address you were never given" filter.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by konschubert on Tuesday October 03, 2017 @09:27PM (#15397633)
I think that marking the mail as spam sends a signal to their email provider, putting a mark on their account?
Re:Yahoo Triples Estimate of Breached Accounts to 3B by jsjohnst on Wednesday October 04, 2017 @10:39AM (#15400740)
Depends on your isp and which email provider they use. The big marketing email services generally do have the feedback loop setup with Gmail though, so yes, you are right.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by dragonwriter on Tuesday October 03, 2017 @05:57PM (#15396576)
> I’ve run a fair amount of email campaigns where we strip out the + if gmail is the domain to ensure it doesn’t end up in some weird filter.

Which works, until the Gmail users who bother using + addresses with filters start giving all legitimate senders + addresses and sending everything thst doesn't have one and doesn't come from Google straight to deletion (possibly with a stop by “mark as spam” en route.)

Re:Yahoo Triples Estimate of Breached Accounts to 3B by BoorishBears on Tuesday October 03, 2017 @06:02PM (#15396600)
The problem is not all legitimate sites/sources will actually accept '+' as a valid email character even though the RFC says it's a valid email character.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by odammit on Tuesday October 03, 2017 @06:03PM (#15396606)
Jinx. :D
Re:Yahoo Triples Estimate of Breached Accounts to 3B by odammit on Tuesday October 03, 2017 @06:02PM (#15396602)
Yeah problem with that is the number of crappy regexps sites use that stop you from signing up with a + address in the first place.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by ribosometronome on Tuesday October 03, 2017 @06:38PM (#15396807)
Sounds like a great way to get your email marked as spam.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by jtokoph on Friday October 06, 2017 @03:25AM (#15415012)
I wonder if it could be argued that this violates anti-spam regulations. Depends on how “plus” addresses get interpreted. Are they a different recipient?
Re:Yahoo Triples Estimate of Breached Accounts to 3B by cm2187 on Tuesday October 03, 2017 @05:36PM (#15396419)
This is pretty useless.

First because it leaks the underlying email (you can safely assume all spammers are well aware of this feature).

Second because if you start receiving spam, you can't stop it. All you can do is to try to deal with the firehose.

A much better solution is randomly generated aliases that you can delete.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by Sohcahtoa82 on Tuesday October 03, 2017 @05:48PM (#15396505)
It really baffles me that people are still suggesting this as advice for spam reduction. All it takes is a third of a brain and a couple seconds of thought to realize that spammers know this is a thing and can adapt.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by glandium on Tuesday October 03, 2017 @06:53PM (#15396900)
They can, but in practice, they don't.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by throwaway613834 on Tuesday October 03, 2017 @07:40PM (#15397157)
> They can, but in practice, they don't.

And you're confident of this how? I'm not actually convinced this is true. It's definitely a widespread belief though.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by glandium on Tuesday October 03, 2017 @07:44PM (#15397186)
Because I'm using the + thing, and I'm still receiving spam to the +ed addresses.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by throwaway613834 on Wednesday October 04, 2017 @12:28AM (#15398256)
Weird, I've done that for a long time too and hardly any received spam to those at all. Good to know though, thanks.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by darrenf on Wednesday October 04, 2017 @04:20AM (#15399009)
Independent of the concept's wisdom or implementation, Yahoo! introduced disposable addresses (originally marketed as 'Address Guard') back in 2003: http://web.archive.org/web/20031023014724/http://biz.yahoo.c...
Re:Yahoo Triples Estimate of Breached Accounts to 3B by magoon on Tuesday October 03, 2017 @05:36PM (#15396417)
Spammers will never find a way around this.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by cortesoft on Tuesday October 03, 2017 @05:42PM (#15396460)
Yeah, you do realize spammers know that, too? They will just strip part after the +
Re:Yahoo Triples Estimate of Breached Accounts to 3B by mschuster91 on Tuesday October 03, 2017 @05:48PM (#15396506)
Of course I do. But most don't bother, and it still works today.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by lttlrck on Tuesday October 03, 2017 @05:43PM (#15396465)
It also works with foo.bar which is a little harder to filter.
Re:Yahoo Triples Estimate of Breached Accounts to 3B by everly on Tuesday October 03, 2017 @07:07PM (#15396984)
Well, not exactly. That would only work if your address was registered as [email protected] but not if it was registered as [email protected]. Essentially, periods don't matter in gmail addresses.

Adding a . in between any of the characters (or removing, if you registered the account to have .'s included) will still go to the same email address.

But you can't add .anystring to your address and still receive the message as you can with +anystring.

This always blows the mind of the average gmail user who thinks they registered [email protected] when they find out that [email protected] also works.

Re:Yahoo Triples Estimate of Breached Accounts to 3B by maccard on Tuesday October 03, 2017 @05:38PM (#15396430)
And many places block email addresses with pluses in it - for example my insurance company