News for hackers. Stuff that matters.
Re:How Retailers Use Personalized Prices by shubhamjain on Sunday October 22, 2017 @12:30AM (#15525165)
The extent of my profile that can be built (and is probably available) is absolutely insane. Picture this: most people use a single email ID to register anywhere. Dating sites, e-commerce, social networks, banks, and even offline stores. My online purchases can be linked with my preferences on OKCupid that can be linked to ads I am clicking that can be linked to my offline behaviour. Personalised pricing is direct result of that. Who knows what other interactions are being shaped by it. Because the power of having this profile is limitless.

There's a Gmail trick to avoid it by using "+random_name" suffix but that is easy enough to circumvent. Disposable email IDs are banned from most sites and I never found it easy to integrate in my workflow. I have been pondering about building a service that acts as a mask to your real email ID, can be configured to forward emails to your real ID and can work with your personal domain name. I know some people who are running similar kind of setup here; a service might be helpful for those who don't might not want to go through the trouble.

Re:How Retailers Use Personalized Prices by blfr on Sunday October 22, 2017 @01:47AM (#15525349)
Whether on Google Apps or using Exim, all my domains have a catch all address so emails to unmatched local names (addresses) are sent to a single inbox. I then use [email protected] for registration at each service.

It's not much more difficult to circumvent than gmail's +randomname but a little fuzzier. There's no way to know from the outside how many people are using each domain.

Re:How Retailers Use Personalized Prices by EGreg on Sunday October 22, 2017 @03:06AM (#15525555)
It is good to use +randomname for another reason: so customer service departments can't be tricked into giving up your data, since the attacker can't even guess your login id.
Re:How Retailers Use Personalized Prices by vtail on Sunday October 22, 2017 @01:53AM (#15525365)
Fastmail offers you up to 100 email aliases (2 per each of 50 different domains) which route to your main account.

Edit: it's actually 600 aliases now: https://www.fastmail.com/help/account/limits.html

Re:How Retailers Use Personalized Prices by imron on Sunday October 22, 2017 @02:51AM (#15525512)
If you're using fastmail you don't even have to worry about that limit. If your email is [email protected] and you are registering with http://www.onlinestore.com/

Just use [email protected] and fastmail will make sure it arrives in your [email protected] inbox.

It's completely hassle free.

Re:How Retailers Use Personalized Prices by akvadrako on Sunday October 22, 2017 @09:21AM (#15526695)
You'll still be uniquely identified. Just using fastmail itself is going to greatly narrow the search for your real identity.
Re:How Retailers Use Personalized Prices by imron on Sunday October 22, 2017 @11:42AM (#15527274)
Except with Fastmail you can use your own domain so it's not immediately obvious that you are using Fastmail.
Re:How Retailers Use Personalized Prices by hiram112 on Sunday October 22, 2017 @05:09AM (#15525836)
Wow - been a Fastmail user for about a decade and have always used aliases (though I'm limited to just 10, I believe, based on my account type).

But this will come in handy!

Re:How Retailers Use Personalized Prices by Freak_NL on Sunday October 22, 2017 @05:16AM (#15525859)
It's not email addresses they want most dearly though (although it is used and correlated of course) it is that nice unique identifier that is your (mobile) phone number. For smartphone apps it is the default (and often only) identifier (and conveniently, it is also the one identifier nearly always present in the contact lists they guzzle in).

A lot of services on the web want your phone number too; as a contact on the shipping label (often a required field), as part of the authentication scheme (out-of-band text messages with OTP codes to confirm certain actions), or as an account recovery option. A person's phone number is a unique numerical identifier that doesn't change often, if at all (in the EU you tend keep your mobile phone number when switching telco's).

Re:How Retailers Use Personalized Prices by username223 on Sunday October 22, 2017 @10:31AM (#15526992)
This is why I'm always reluctant to sign up for 2FA, opting instead for long randomly-generated passwords and a password manager when I care about an account. Google/FB having my phone number is way worse than someone hacking my crappy FB profile or spam-catching Gmail account.
Re:How Retailers Use Personalized Prices by sleavey on Sunday October 22, 2017 @03:50AM (#15525670)
I run my own email server and set up a catch all address so I can give any website a new email address at my domain. It was a bit of a pain to set up initially, getting other servers to accept sent emails, but maintenance is pretty straightforward.
Re:How Retailers Use Personalized Prices by imron on Sunday October 22, 2017 @02:52AM (#15525515)
> Disposable email IDs are banned from most sites and I never found it easy to integrate in my workflow.

Sign up for fastmail. Integration is completely painless. https://news.ycombinator.com/item?id=15525512

Re:How Retailers Use Personalized Prices by callalex on Sunday October 22, 2017 @03:10AM (#15525564)
This is just a minor variation on the plus tag in gmail addresses, or am I missing something?
Re:How Retailers Use Personalized Prices by imron on Sunday October 22, 2017 @03:54AM (#15525676)
It is! Except sites can't just do a regex to test for '+' so it's not easily detectable as such.
Re:How Retailers Use Personalized Prices by c22 on Sunday October 22, 2017 @01:05AM (#15525243)
I do this with one of my domains. Setting it up was just adjusting some forwarding preferences in my registrar's web interface. Not sure how a separate service could make this easier, I'd presumably still have to login to my registrar to point an mx record at it.
Re:How Retailers Use Personalized Prices by twhb on Sunday October 22, 2017 @05:10AM (#15525839)
https://33mail.com and https://mailhero.io both offer what you're describing. https://mailinator.com is disposable email that reliably avoids block lists by showing (on their homepage) only one of their list of forwarded domains.

Also, the plus thing isn't Gmail-specific, it's part of the email protocol.