News for hackers. Stuff that matters.
Re:An Ode to Apple’s Hide My Email by b1n on Sunday April 10, 2022 @04:38PM (#30981465)
I've been thinking of a new way to use my email...

- Only use one email address: [email protected]

- Always add a filter: [email protected]

- Send all emails without a filter to SPAM

Since it's not a common strategy, it is much more likely that spammers remove the +hn before sending an email than add one.

Re:An Ode to Apple’s Hide My Email by VTimofeenko on Sunday April 10, 2022 @05:13PM (#30981764)
I have tried this approach. Unfortunately, some services will not accept plus sign in the username no matter what RFC says. On top of that, some services seem to not like seeing the service name in the username. I.e. foo.tld will refuse sending email to [email protected].
Re:An Ode to Apple’s Hide My Email by quitit on Monday April 11, 2022 @04:46AM (#30986211)
Shopify also flags orders (even if they are fully paid) when the customer's email contains the shop's name. I'm sure their logic is that it helps cut down on fraud.

I prefer the system of using a basic abbreviation in the email address to avoid these types of filters but still make the email easily traceable later. Say your name is joe smith and you're buying from Sports Online. Something like [email protected] works well for later confirming whom you gave the address to.

I like this approach because one doesn't have to track all of the catch-all emails made on the fly, since finding out who you originally gave that email to is just a matter of searching your past email and noticing that "spo" looks more like those old Sports Online emails and not the new spam from discounted wholesale fancy rugs.

Apart from seeing who a company has on-sold your information to (or more rarely had a staff member steal their database), it's also an easy way to see who has been hacked.

One other reason not to use something like [email protected] is that some websites exist merely as credential honeypots and those types are usually aware of this approach and will then typically exploit the catch-all for spamming. The shady All on MP3 service was known for doing this. (I'm pretty sure that site existed solely to exploit the fact that most people used the same password for everthing.)

Re:An Ode to Apple’s Hide My Email by Semaphor on Sunday April 10, 2022 @11:32PM (#30984308)
> I.e. foo.tld will refuse sending email to [email protected].

While I never had that issue, I had Foo’s legal service contact me about using their trademarked name in my email (a short explanation cleared it up)

Re:An Ode to Apple’s Hide My Email by kevin_thibedeau on Monday April 11, 2022 @02:10AM (#30985257)
It is better to use this scheme with an underscore or hyphen as they won't be rejected by incompetents like plus is.

name_nospam@blah

Re:An Ode to Apple’s Hide My Email by Semaphor on Monday April 11, 2022 @02:56AM (#30985517)
I actually use [email protected].
Re:An Ode to Apple’s Hide My Email by JimDabell on Sunday April 10, 2022 @06:38PM (#30982434)
Some mail providers support receiving mail on arbitrary hostnames, so you can set up a wildcard MX record and then use [email protected] instead. This avoids email validation issues with plus addresses, spammers don’t try removing any parts of the hostname, and I think in the many years I have been using it I’ve only run into a problem with including the service name once or possibly twice.
Re:An Ode to Apple’s Hide My Email by drexlspivey on Monday April 11, 2022 @08:24AM (#30987728)
AFAIK the only provider that supports that is Fastmail and it kinda defeats the purpose of using your own domain because if you are forced to migrate you are toast.
Re:An Ode to Apple’s Hide My Email by ricg on Monday April 11, 2022 @05:54AM (#30986599)
Which mail providers support this? I'd like to set up something like this. Thanks!
Re:An Ode to Apple’s Hide My Email by strboul on Sunday April 17, 2022 @05:21AM (#31059595)
StartMail supports a form of this called as "aliases" with the StartMail domain.

https://www.startmail.com/

(Disclosure: I work at StartMail.)

Re:An Ode to Apple’s Hide My Email by paledot on Monday April 11, 2022 @08:49AM (#30987958)
I do this with ProtonMail. I have it set on a subdomain, though: my regular email is [email protected], while my account email is [email protected]. This avoids the spam sent to asdf@everydomain.
Re:An Ode to Apple’s Hide My Email by lloeki on Monday April 11, 2022 @06:34AM (#30986867)
Fastmail, can't recall if assuming you want to achieve something like name+tag@domain it would be [email protected] or [email protected] (IIRC the latter)
Re:An Ode to Apple’s Hide My Email by JimDabell on Monday April 11, 2022 @06:46AM (#30986932)
You can do this with Fastmail by going to Settings => Domains => Edit => Routing.
Re:An Ode to Apple’s Hide My Email by ricg on Monday April 11, 2022 @07:19AM (#30987160)
Thanks a lot! I'll give it a try.
Re:An Ode to Apple’s Hide My Email by tlavoie on Monday April 11, 2022 @07:14PM (#30996424)
Some MTAs (Postfix at least) allows other characters. I use an underscore, which seems universally accepted. For the second problem, there's usually some alternative mangling that would still be unique-enough, or just flee because they seem too aggressive on the data harvesting.
Re:An Ode to Apple’s Hide My Email by vmception on Sunday April 10, 2022 @05:39PM (#30981991)
would not recommend

not only can you not sign up to many services, customer support can often get confused when you need to email reply to them and you cannot email from your aliased email. they see you as a separate user not in their system, or the wrong person replied to the support ticket, etc.

Re:An Ode to Apple’s Hide My Email by rootusrootus on Sunday April 10, 2022 @07:33PM (#30982846)
On Fastmail, at least, this isn't a big issue. For a catchall account, if I reply to an email[0] it automatically addresses the reply as from the alias. It is editable in place, too, in case I want to give it some other name.

[0] In their webmail client, of course

Re:An Ode to Apple’s Hide My Email by ohlookabird on Monday April 11, 2022 @01:56AM (#30985180)
But why would you not be able to reply with the aliased email? I do this regularly. Of course your mail client needs to support this, but using Mutt this is absolutely no problem (just change the FROM header) and I have heard from other users who use Thunderbird that they can also create new identities (just not as easy on the fly). In fact I wrote a small script for Mutt that would automatically set the correct sender if I reply to an email that contained a wildcard. Works pretty well.
Re:An Ode to Apple’s Hide My Email by mackmgg on Sunday April 10, 2022 @06:27PM (#30982351)
Can you not reply from a [email protected] alias? I use the catchall approach (so just [email protected] when signing up for foo), but if I need to email customer support I'll just send the email from [email protected]. I've never tried that with a + in the account though to see if my client supports it.
Re:An Ode to Apple’s Hide My Email by IAmEveryone on Sunday April 10, 2022 @06:35PM (#30982412)
Gmail also ignores the dot. If you choose a 17-character mailbox name, you can use any one of 2^16 different patterns of placing dots between them.

Capitalisation could also be used for such a purpose, but may be more likeely to accidentally get stripped.

Re:An Ode to Apple’s Hide My Email by mushyhammer on Sunday April 10, 2022 @08:09PM (#30983095)
Dots are useful to create new accounts on the same site, but you can’t use it to just tell websites apart (because there’s no label)