Hacker News Reader

Yeah, the + trick is not that great, because it is quite obvious what your real email is. This way, not so much. One could of course still guess that you are using this trick when they see that your email matches their domain name. If you're paranoid about that, you could of course just use <random string>@yourdomain for every login. And store that in your password manager.

View on HN

Anything at a custom domain that doesn't look direct to an individual (e.g. not realname@domain.tld) is a big hint to spammers that the owner uses a catch-all and thus any address will get the job done. I suppose you could go with a whitelist for every random address you give out and blacklist the ones that misbehave, but that's a lot of work and, since every company misbhaves these days, including entities like banks, you'll likely miss emails you actually need.

I don't care much about spammers. The filter at FastMail is good enough. What I care about mostly is to make automatically correlating my identity between different websites harder.

> you could of course just use <random string>@yourdomain for every login

You could also use the hash of the domain name with a secret salt value. Then if you somehow lost your login info, you could still figure out what your recovery address was if you still knew the salt.

Reply on news.ycombinator.com