News for hackers. Stuff that matters.
Re:Firefox Relay by Vinnl on Wednesday November 17, 2021 @09:08AM (#29253110)
Heh, I work on Relay and I do the same :) While the approach is great, especially in situations away from my computer where I can't generate a new alias in advance, working on it I discovered that using Relay still has a couple of advantages:

- My other addresses are unguessable.

- It's far easier to block emails sent to a single alias. With my own domain, I'll have to go and add a filter into which I copy-paste the particular alias I want to block. With Relay, I can just open the dashboard and hit the toggle next to the alias labelled with the domain I used it on.

- I was looking for ways to give Mozilla money for a long time (though now I'm working there, so I guess I'm also taking its money).

In general, my setup now is to keep using my old setup for long-term accounts with somewhat more reliable services, and use Relay for e.g. requesting a quotation or having a single thing shipped to me.

Re:Firefox Relay by mike_d on Wednesday November 17, 2021 @04:45PM (#29259261)
What is Relay going to do when the domain ends up on one of the many "disposable email address" blocklists?
Re:Firefox Relay by Vinnl on Thursday November 18, 2021 @06:01AM (#29264136)
We're actively reaching out to maintainers of such lists (see e.g. [1]) to get us removed, and take a number of measures to make that more palatable (see also [1]). And of course Relay is a bit different from services like Mailinator, where email addresses are usually actually single-use: Relay addresses remain active until their owner actively disables them. Possibly in the future it might also be possible to bring your own domain, but I don't think we have any concrete plans for that that we can share.

That said, no solution is perfect, and I expect that there will likely always be situations where you will be forced to fall back to a regular email address.

[1] https://github.com/wesbos/burner-email-providers/pull/339

Re:Firefox Relay by VTimofeenko on Wednesday November 17, 2021 @11:16AM (#29254985)
On the unguessability of other addresses - I rotate several schemas making the mask of the address something like [service].[username].$(pwgen -1 | tr '[:upper:]' '[:lower:]')@customdomain.

Sometimes "[service]" is also shortened like "hackernews -> hn" to dodge the ban on service name in the e-mail address that some service providers apparently have.

Re:Firefox Relay by Vinnl on Wednesday November 17, 2021 @11:44AM (#29255371)
Ah, I don't necessarily mean guessability of which other addresses I use, but of how you can reach me. If I block [email protected], you can still attempt to reach me at [email protected] and it will work. You'll also be able to link my different addresses on different services. If I throw away the Relay alias for your service, that's it - there's no way to lead that back to me anymore.
Re:Firefox Relay by VTimofeenko on Wednesday November 17, 2021 @02:18PM (#29257594)
Gotcha.

> you can still attempt to reach me at [email protected] not if the catch-all address is actually /dev/null and the totallynotyourservice@ has to be mined from somewhere because it's random.

Overall, I think it depends on the obfuscation strategy. It's true that having a unique @mydomain.com part is a big giveaway and someone could theoretically track one's activity by searching for all e-mail addresses coming from the domain.

My use-case is more to use unique e-mail addresses to throw off credential stuffing attacks, not become untrackable/avoid all spam. For the tracking use-case I generally think several times if I want to register somewhere at all and try the usual routes first (mailinator, random old addresses on public e-mail).