- My other addresses are unguessable.
- It's far easier to block emails sent to a single alias. With my own domain, I'll have to go and add a filter into which I copy-paste the particular alias I want to block. With Relay, I can just open the dashboard and hit the toggle next to the alias labelled with the domain I used it on.
- I was looking for ways to give Mozilla money for a long time (though now I'm working there, so I guess I'm also taking its money).
In general, my setup now is to keep using my old setup for long-term accounts with somewhat more reliable services, and use Relay for e.g. requesting a quotation or having a single thing shipped to me.
That said, no solution is perfect, and I expect that there will likely always be situations where you will be forced to fall back to a regular email address.
[1] https://github.com/wesbos/burner-email-providers/pull/339
Sometimes "[service]" is also shortened like "hackernews -> hn" to dodge the ban on service name in the e-mail address that some service providers apparently have.
> you can still attempt to reach me at [email protected] not if the catch-all address is actually /dev/null and the totallynotyourservice@ has to be mined from somewhere because it's random.
Overall, I think it depends on the obfuscation strategy. It's true that having a unique @mydomain.com part is a big giveaway and someone could theoretically track one's activity by searching for all e-mail addresses coming from the domain.
My use-case is more to use unique e-mail addresses to throw off credential stuffing attacks, not become untrackable/avoid all spam. For the tracking use-case I generally think several times if I want to register somewhere at all and try the usual routes first (mailinator, random old addresses on public e-mail).
Which was fine until I had to verify my identity in-person at a Verizon store to cancel service and had to explain why I wouldn't be able to receive a verification email to verizon@mydomain for a while. Also annoying for my 401(k) which uses SMS for 2FA and makes the codes expire after 2 minutes.
Since then I've switched to a custom domain with iCloud, which unfortunately doesn't support catch-all addresses at all, but is more reliable and faster.
This is what has finally ended my years of Microsoft Office use: Outlook will not let you keep your primary address out of smtp headers. No way, no how.
> Word of advice for anybody doing this: make sure you have a way to SEND email using one of your aliased addresses
So a) you need a mua like thunderbird that let's you set FROM header - and b) your domain need to be setup to allow your smtp server(s) to send from your domain (sfp).
The custom From is just a way to send from any address for that catchall, I was not suggesting to use it to send from abitrary addresses, which would be quite pointless since you then wouldn't get the replies.
This is great for categorizing messages. And you can still blacklist aliases that have been leaked to abusers.
I keep reading about people who say they have a custom domain, but I'm not sure they're aware of the caveat to that. You have to keep renewing it, and domains are infamously changing hands all the time, sometimes to bad actors who want to use the SEO juice of the domain for spam or affiliate marketing, or in the worst case: to take over your identity with it.
By all means, yes, keep it renewed, but if you stop renewing it (for whatever reason), assume all the accounts you have tied to it will be in someone elses hands.
My solution: make sure you keep your domains renewed to the maximum allowed by your registrar if you can. 10 years with dotcoms.
Anyway the trouble is writing mail to those services or replying to those. I have 13 from email usernames in my Mail.app right now on my domain. Then I stopped it. It’s just so tedious.
I wish there was an app that would let me easily do it once I proved I’m the domain owner maybe - just let me send an email from <anything>@<my domain>.tld without having to add one separately. It should also allow me to reply from same email without hassle
I tried Apple iCloud+‘S HideMyEmail feature, but:
- It’s a harder lock-in into their ecosystem
- Not available on custom domain
- You can reply from that random email username if you get email username, but you can’t start a conversation easily.
- when you stop paying those randomly generated Hide My Email are gone
- Not very convenient in the browser especially if you are not in Safari or a Mac.
The compose view looks like this: https://imgur.com/a/qULeL5a
The only issue I have had is non-technical people getting confused when I have their business name in my email address.
I haven't used this service, only heard about it. It might cover your missing piece for credit card info.
Of course, privacy.com ends up being the one that can aggregate your CC information together.
So, I just googled them, they look interesting but their website seems intent on obfuscating what they do, it uses a lot of marketing speak but doesn't tell me how it works.
Are you able to use your own domain for the "email masking"?
Are you giving them your bank info for the credit card masking or are they billing the credit card on file?
I did self-host this way back, using MailEnable on Windows Server. It... worked. But I don't recommend it!
The other downside is that the catch-all sometimes gets a lot of [gibberish]@[customdomain]. It's not too bad now, but there was a period where gibberish hexidecimal aliases were spammed regularly.
A targeted hack that could get 2FA tokens or a social engineering attack on the registar aren't threat vectors I'm concerned about. I'm not that interesting.
Much better than being at risk of, for example, Google cancelling your Gmail account for whatever reason, or your mail account getting hacked.
The likelihood of a takeover of @gmail.com or @icloud.com is much lower though.
You can manage the aliases within the same parent account.
Instead of using the same email address and different password per site, I use my "burner" domain so foo.com@burner and just use the same password for everything. Nothing to remember for a login - just the domain name and the usual password.
For "important" things (anything with money or PII etc) I use a unique password + bitwarden
I have a custom domain just for signups, and I sign up with [service].[username]@customdomain. The domain simply has a catchall email "accounts@customdomain"
Combined with a password manager (Bitwarden) this is absolutely brilliant.
* Spam: if I get any spam, I know exactly which company is responsible, whether directly, through selling user data or because of breaches. And I can simply block the whole alias.
* Multiple accounts: If you need a second account with some service, you simply use a new alias. No need to worry about secondary emails just for a few accounts.
* Mitigate data leaks: if some database gets compromised, all they get is a throwaway email. They also can't try to log in to other accounts or do password resets if they get a hold of the password. (somewhat redundant with a password manager and unique passwords, but still)
* Privacy: all those ad data aggregators have a harder time connecting me between accounts. (of course they still use names, address, credit card info, etc; but it helps)
* Easy self-hosting: email hosting can be a pain. But in this case you only need to receive, never send. And receiving basically always works, even with the most broken email server setup.
A downside is the unique domain name. I always wanted a shared domain with lots of users to further reduce exposure.
I actually thought about starting a service that provides this, but it's a niche product with non-trivial technical hurdles and potentially lots of support demands, so I'm happy that Mozilla is offering this.
The only downside is that people get really confused when they have to deal with your email, for example when calling support. But it's never been a real issue.
Highly recommended!