Hacker News Reader

Comment by WirelessGigabit | Hacker News Reader

Including your email address.

And then you abandon the cart, because it doesn't make sense for you to pay $50 for shipping.

But then you get those emails 'you forgot something'. No I didn't.

And you're forever on their "mailing list" because they don't process unsubscribes, since they probably just manually upload a .csv of everyone every time they want to send something to you, whether you ever opted in, or not.

Then you are justified to put them on the spam filter.

I just got done switching from gmail to fastmail, and it solves this problem beautifully with a nifty feature allowing me to create a new proxy (“masked”) email address for every website but have the mail show up in my mail address. There’s a limit, but it’s like 600+ or something. So when the email gets sold and I start getting spammed, I can easy kill it, and also know who the culprit was.

This one is paid, but I’m at the point where $140 for 3 years “standard” package is fine by me. Not to mention I can actually call someone if I have a problem, instead of getting blocked by google for no particular reason without any recourse. I don’t have a huge social media following that can get me special treatment.

There may possibly be free options that allow you to proxy/mask emails, but I’ve not explored that.

Another useful service is privacy.com, which in a similar manner let’s me create proxy virtual payment cards, setting limits and redacting cards. This kills the possibility of a malicious business like a telecom still charging me for something and having the bank still allow it to go through when they shouldn’t. Now my credit union is pretty good so far, but there are a lot of banks that will happily fuck someone over without a care.

It’s nice having no mean _No_

I do this on gmail myself. I have my own domain and pay for gmail on it. I have a wildcard set to go to my mailbox and wildcard stuff gets sorted per usual. So for instance, if I buy something at target, I use/sign in w/ target@mydomain.com.

I know I should probably get off of gmail, but it's a really good service for my needs.

It's also reasonably priced and there's no limit for those email addresses since it just captures every email sent to my domain.

Downside is I can't send from those addresses but that's generally okay for me.

I used to do this but ended up in too many situations on the phone where someone says “what’s your email” and I can’t remember what email I gave them and I look like an idiot who doesn’t know what their email is.

Now I just mark any marketing email as spam and let the email service automatically move all future emails to spam.

I did too, and I’m not sure what the best fix is.

Proton has SimpleLogin after buying it, but then they own me forever as much as the next company, with the caveat that they can raise fees. Just your username and (ridiculously crazy, 26 character) password isn’t good enough anymore-“oops, we need to send you an email before you can log in” is rapidly becoming normal.

> solves this problem beautifully with a nifty feature allowing me to create a new proxy (“masked”) email address for every website but have the mail show up in my mail address ... So when the email gets sold and I start getting spammed, I can easy kill it, and also know who the culprit was

I do something like that too, but I have my own SMTP server. It doesn't use + it is just an entirely different email address for each one.

I can also easily send from any address by the -r switch.

And not just airbnb@example.com, because that can be guessed, but airbnb_itjeof@example.com, such that you can be sure it leaked from their database.

Solution to this is to use a masked email or at the very least add a `+` tag so you can block it easily or know who's the source of the junk mail.

Fastmail offers this feature, and I think 1password might. The `+` tag should be possible with any provider, `me+hn@example.com`

Of course now you have to have a way to keep track of what email you gave to what company. I usually do `firstname_company/website@` to make it easier to remember.

That's not really a viable solution for the average, not-so-tech-savvy folk, though.

Edit: Hit me with the downvotes, I don't mind, but I also enjoy hearing about why my perspective might be wrong. From where I sit, I can imagine that plenty of people annoyed by these kinds of email harvesting patterns also don't know enough to employ the kind of method described here. I feel like that's a solution, but not one that can be prescribed to the average joe.

That's not really a viable solution for the average, not-so-tech-savvy folk, though.

Not at this moment, but we're getting close

More and more often, Safari offers to fill in an anonymized email address for me when I fill out a form.

It's not detected and offered 100% off the time, but is improving.

Even my wife has started using it, and she is not a techie.

> That's not really a viable solution for the average, not-so-tech-savvy folk, though.

You can explain this feature of gmail/fastmail to a reasonably technical person in 5 minutes, where 'reasonably technical' means that the person understands the concept of mail folders. Sure, it might not work that easy for your grandma, but I'm reasonably certain that most people in the developed under 40 fall in that category.

Isn't it trivial for websites to strip out the +? I feel like between this, and the various sites that don't support + in email addresses for whatever reason, this trick isn't worth doing.

Yes, and any spammer will do this anyways. This is the digital equivalent of spelling your name backwards for anonymity. I don’t know why people still suggest it.

It still works, in my experience. Also, stripping out the plus is risky for sites, as it might actually be a part of the address, especially if it's not @gmail.com.

You can get a tad fancier and automatically mark mails without + as spam (only works for new addresses, obviously) or use a dash as separator (if your mail provider supports it). This won't block a targeted attack, yes, but it's usually sufficient to filter a lot of low quality spam and to identify companies that sell or leak your data.

>Also, stripping out the plus is risky for sites, as it might actually be a part of the address, especially if it's not @gmail.com.

Sure, stripping out everything after the + isn't specified in the RFCs, but I know of zero public email providers that allow + in email address AND treats them as separate address (eg. foo+bar@example.com is a different account than foo+baz@example.com).

>You can get a tad fancier and automatically mark mails without + as spam (only works for new addresses, obviously)

Sites that reject + in email address preclude you from doing that.

the '+' is valid according to RFC822 from 1982. It's not purely per service provider.

http://www.faqs.org/rfcs/rfc822.html

Email alias is the only reliable way. If I was writing an email spam service the first thing I would do is strip off everything after the plus sign.

I do this on purpose because about 24 hours later sometimes they'll send you a 10% off code.

Reply on news.ycombinator.com