Hacker News Reader

Comment by KirinDave | Hacker News Reader

Thanks Every Employer I've Had In the Past 6 Years For Putting My Email In A Service I'd Never Want Otherwise.

Also Thanks Me for just using docusign w/ our employees when I was in charge.

I strictly started handing out "companyname@mypersonaldomain.tld" as email when interacting with companies. That at least makes routing the inevitable spam to the trash bin slightly easier when a breach occurs. It also provides an indicator of who has (in)voluntarily given away my data.

I do the same with Gmail, just add + at the end (As in username+docusign@gmail.com). Of course this has the drawback of some sites being to restrictive with their checks for valid emails and not allowing the + character

The other disadvantage is that it's trivial to infer the true username from that pattern in an automated fashion.

Yep, it's not foolproof but it's better than nothing. And considering that the number of people using it aren't that many (I guess) spammers wouldn't bother

If I were a spammer I'd loop through my email address list and strip out + and anything between it and @

Actually most of the web sites do not accept the + character.

Actually my experience is the opposite :)

I've been doing this for awhile. It's especially interesting when giving it to a representative in person, some people will refuse to enter it in their systems. I've also had one webform reject it outright. Lately I've started just using random words to get around this awkwardness and make my pattern less predictable. When I get the first email from that company (often happens within minutes) I just give it the actual company's name as an alias in my client.

They often ask me: do you work for <company> too?

or "you can't have that email address, that's our companies name."

AliExpress does this, they don't accept "aliexpress@foo.bar". I suppose it's meant to stop you from providing "foo@aliexpress.com", implemented lazily by rejecting anything that contains the substring "aliexpress".

Best response I've received when giving an email address of the form "company@mydoma.in" to a representative in person was "oh you work here too?". The concept of catch-all domains is so foreign to most laypeople that it takes quite some explaining ("I get everything that's sent to any address at that domain", "no it's not expensive at all", "it helps me automatically sort my email").

>>> I suppose it's meant to stop you from providing "foo@aliexpress.com", implemented lazily by rejecting anything that contains the substring "aliexpress".

Most likely it is to stop you from making an address with "aliexpress" in it, so you don't look like affiliated to aliexpress in any way (think: phishing).

A catchall on my domain was all fun and games till the second dictionary spam run.

I haven't had any issues with that and I've been using a catch all setup for about 7-10 years. Most spam arrives on the actual primary email address.

This was a while back, and I'm guessing that now there are enough gigantic lists of verified emails that the technique lost it's minimal rate of return.

It was a massive headache at the time tho.

I've heard that being a problem, though I've never had that issue using a sub-domain for the catchall (company@sub.domain.tld).

Some sites refuse to accept email addresses with more than one "." after the "@" but figure if they don't understand email addresses I don't want to trust them with my details (even throw-away ones) anyway so go elsewhere.

Lots of sites also strip the "sub." part from the domain. I have no idea why they think this is a good idea, but a friend of mine does this and he's got at least ten companies in his main domain's alias table because they silently stripped the "sub." part.

Gmail allows you to do extension addresses like "myname+company@gmail.com", which I've used since switching away from my own mail server where I did the catch-all. Some places are rejecting "+" in the address though. I was trying to give on to Dell and the tech I was talking to told me the system wouldn't accept the address, but that the "+dell" was just an extension "so can I put it in without that?"

The combination of them knowing that this was valid and just wanting to strip off the extension kinda blew my mind for some reason.

I can confirm exactly this. I started with a root catchall on my personal .com (~15 years ago), and it was quickly overwhelmed with dictionary spam. Switched to a subdomain catchall, and haven't seen a dictionary run since.

Picking a short preposition for the subdomain can even help when you have to communicate the email to a clueless phone rep: "That's right, it's yourcompany@for.myname.com"

The way I get around that is by having a static keyword that must also appear on the user side of the email address.

So, if I'm dealing with Walmart, I would give them:

[keyword].walmart@example.com

walmart.[keyword]@example.com

Then I configure my catch-all settings to reject any email addresses that don't have that keyword.

Of course, the keyword is not secret, so it's possible for someone to infer what I'm doing and construct an email address that passes my spam check, but in practice, nobody goes through the trouble, because I'm not a big enough target.

Yeah, I wound up using name-tag@domain, but because I used a dash rather than plus, I'm forever doomed to run my own mailserver.

(fwiw, this domain is almost 20 years old, so that's forever in internet years)

I use my domain with FastMail, they support aliases and catch-all and lots of other nice things on custom domains. They also do DKIM, SPF, etc. So you don't have to run your own mail server if you don't want to ;)

https://www.fastmail.com/help/receive/domains.html

https://www.fastmail.com/help/receive/domains-setup-mxonly.h...

https://www.fastmail.com/help/receive/alias-catchall.html

https://www.fastmail.com/help/receive/addressing.html

https://www.fastmail.com/help/receive/domains-advanced.html

Fastmail uses a +, I use a -. So, either I'd have to go in and alias all of them, or give up on the useful ones.

Besides, there are 30 or so that I have black holes, from back when comment systems leaked email addresses.

Sounds vaguely like the way email addresses work in Ender's Game - typically, all mail would go to user%SECRET@server, and if you don't know SECRET, the email presumably bounces.

I've done similar with a catch-all sub-domain for years. It does mean that my mail server sees a lot of junk activity as some email lists out there have many addresses in that sub-domain on them, but at least they are easy to filter out.

Some sites refuse to accept email addresses with more than one "." after the "@" but I figure if they don't understand email addresses I don't want to be trusting them with my details, even throw-away ones, anyway!

Unfortunately I was added to docusign by someone else who gave them my main address...

I love their reaction when I say their company name then pause

a co-worker got a trademark infringement notice when he used companyname@hisdomain.tld to interact with a particularly litigious software company. They assumed he was a reseller and was representing himself to others using the same email address.

Yeah, I should stop being lazy and host a personal domain again. It just is such a bad situation these days. Either you:

1. Pay a reasonable rate for a full time server in services that are just truly awful, have no redundancy options, and are associated with a lot of unsavory activity or...

2. You pay a totally unreasonable rate to host it in a more reputable cloud service.

3. You run it out of your home or office and deal with your locale's interent. In my case (California Bay Area) it's bad.

I do the same thing as Xylakant, but my email all goes through gmail (which has its own problems and caveats, but has the advantage of being free beyond the domain name registration.)

I host my email at runbox, but many other providers offer catchall on custom domains. No need to host your email yourself.

I do that too, so far Adobe, Dropbox and LinkedIn are my only real sources for spam (due each of these being hacked). And oddly the occasional spam to an alias I used for the crypto-discuss mailing list.

One additional twist, I keep my site-spesific aliases on a short sub-domain (for now service-or-tld@s.mytld.com) - if I feel the need in the future I can burn down the whole sub-domain, exchanging s.mytld.com for eg: m.mytld.com.

I only met docusign in a brief spell and vaguely remember it looked like some kind of borderline scam for enterprise security checklisters.

How does clicking a link from an email prove identity? How does it work?

>How does clicking a link from an email prove identity?

Most of these document signing services, as you point out, don't prove identity. They provide a more convenient simulation of the "download, physically sign, scan and return, a pdf document" process. Which doesn't prove identity either.

Personally, I appreciate the shift. It's just as silly, but less cumbersome.

At least they didn't ask you for ransom of 1 bitcoin. lol

Joking aside, this is an inevitable event and we just have to be cautious and ready when it does happen.

Reply on news.ycombinator.com