Hacker News Reader

Comment by danielweber | Hacker News Reader

The way some people do "fredsmith+amazon@gmail.com" as proof that it must be amazon that leaks their passwords has some issues.

The guy who says that he had a truly random bunch of letters as his dropbox account is probably a better indicator, but it's hard to know if the guy ever leaked it himself.

Doesn't excuse the moderators being jerks, though.

View on HN

When I try subaddressing as I try to sign up for new online services, more often than not that address format is rejected as invalid. Most online services don't have very good email validation.

Use a whole domain name, e.g. signup for dropbox with dropbox@tokenadult.com. You could do this with Google Apps Gmail by setting a catch-all forwarding address for the domain.

It's all fun and games until you get attacked by a spambot that tries blindly sending thousands of messages to <common_user_names>@yourdomain.com

I have a setup like that, I get more spam because of that of course but Google is really good at filtering it. And especially in conjunction with priority inbox, it's a breeze (and very convenient).

Yup. I used to do this with a personal domain. After a while I realized that the spam folder was filling up faster than I could manually empty it!

I use a sub-domain (e.g. @m.mydomain.com) for my catch-all and this hasn't happened to me. There are various easy ways for spammers to find out about domains, but sub-domains can remain relatively obscure.

Hey, that's sharp.

Oh that's a nice trick, I might give that a go - thanks!

Or worse, using <randomchars>@somesubdomain.example.com as the SENDER address on spam to others. I once had spammers find a subdomain that accepted wildcard emails, and the backscatter was just insane. Had to spend a whole day trying to make a list of valid <usernames>@ on that subdomain to whitelist to put an end to it. (Not easy if you haven't already been keeping track of which addresses you've handed out throughout the years)

Wouldn't it be better to setup a new nickname/alias for your account? A bit tedious but then you wouldn't be getting every single xxxxx@example.com

Yeah, I've got postfix setup so I just need to add a line to a textfile with "servicename.somerandomchars[1]@mydomain" and it's starting to route to my inbox.

When an address is "compromised" and starts to receive spam, I move the line to a "banned_recipients" file with an SMTP reject header listing the new email. That way, a human using an old address would get a bounce back with the new email.

[1] so that the argument about bruteforcing "common-service@domainname" can be avoided

That's a nice technique; thanks for sharing it. This kind of flexibility is one of the many benefits of running your own mail server (I'm always happy to see that at least some people here are still doing that).

If you run postfix you can have that even easier; look for smtpd_recipient_restrictions and check_recipient_access in 'man 5 postconf'.

I'm running with this rule in the access map:

   /^from-.*@foobar.com$/ OK

That accepts all mail to an address prefixed with "from-" and (by default) rejects everything else. This way you can just make up the dummy-addresses on the fly.

I remember being slightly worried about using such a simple prefix when setting it up initially. However I have never received mail to a from-* address that I didn't "create". Not once in over 6 years.

And disabling an address that has turned spammy is as easy as:

   /^from-stuffit-expander@foobar.com$/ 554 No thanks.

I changed my mail server to accept . instead of +'s so now the emails I generate work through pretty much any validation.

I've also done that and I've just recently added _ to the mix, which I think is particularly devious and wholeheartedly recommend.

These (the dot and underscore separators) are a great solution, because when the spam-happy-marketroids try to get the webdevs to intentionally implement broken email address validation, they can point out all the corporate email addresses which are by-policy of the form "firstname.lastname@domain.tld"…

Yeah, so much for RFC2822. Oh well, apparently, some spammers are clever enough to grep the emails with "+" and throw away the obvious additional portion.

The author of that rfc should be shoot. Of course nobody obeys a standard which requires you to handle comments in email addresses.

I'm not sure I understand. Which part of that RFC are you responding to?

It's actually _not_ because their validation sucks, but because salespeople decided that it means you won't read their newsletter or other spam. They understand the situation as - hi, this is my email please use that subaddress so I can mark it as spam (yes, I know that spam filters don't need subadresses - but try to explain it to an average salesdude - I've tried).

I have anything sent to any address at my vanity domain forwarded to gmail. I use the name of the website and add e.g. ".shop@mydomain.tld" or ".bank@mydomain.tld" so I can apply different labels to them in gmail. It works great except I chose a .info domain which some sites don't recognise as valid.

I should also have said that this system means that for forums I feel safe enough using the same password on all sites as it will never be linked with the same address. (I still use a different (predictable for me) password for banking/ecommerce websites)

Some of the posters seem to be saying they have received spam on a single, dropbox-specific address on their own domains, though, presumably with catch-all email, so that an attacker wouldn't just have had to guess fredsmith.dropbox@fredsmith.com, but also not tried a single other address @fredsmith.com

Speaking of which, this alias system from google is great in theory, but kind of pointless in practice; spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias.

It's not from Google; it's called subaddressing: http://en.wikipedia.org/wiki/Email_address#Address_tags

It's pointless in practice in theory; in practice in practice spammers (in my experience) don't target + aliases. And if you think about the set of people who are likely to give money to spammers, the set of people using + aliases, and the fraction of + alias space that is occupied versus the fraction of non-+'aliased space that is occupied, the reason why becomes clear.

I've tried to use this system in the past, but found it to be a PITA. A lot of email systems won't let you use a +. The other gotcha I get is that they use the email address as a login token (Dropbox, for example). So you have to remember a) that you used a token and b) what it was. Any suggestions on approaching these?

I use domaincom@mydomain.com, e.g., dropboxcom@mydomain.com.

1Password (or equivalent).

Even though a service might desperately want to know my personal and/or business email address, and disguise that desire with the usual "Hey, just use your email address as your login username!", doesn't mean I have to comply. Unless they're prepared to accept responsibility to disclosure of my address, I feel perfectly happy taking the required measures to minimise those risks myself - no matter what they attempt to enforce with crappy email validation or ToS requirements.

(And, although Dropbox have finally arrived in their forum-thread ~24hrs late apologising for their "community moderators" calling their customers idiots, the responses from Nathan and especially Chris only strengthen my resolve to ignore any attempt by companies/services to gain access to my personal email addresses as part of their user databases.)

I always use the domain-name minus the top level for my token. So if my base email were "david@example.com", for "dropbox.com" it would be david+dropbox@example.com. That makes it very easy to figure out all the emails I might have (since I'm essentially just remembering an very simple algorithm to generate them). Very often sites have sucky email validation that rejects "+" so I configured my system to allow . and _ to also work the same way. That way I can choose david.dropbox@example.com or david_dropbox@example.com if the + doesn't work.

I once ran into the problem where a retail site forced me to sign up before paying, then refused to accept Paypal payment from any address except the one I signed up with. Of course my Paypal wasn't myemail+retailsite@gmail.com. Very annoying.

That's true for a negative filter, but not a positive one; although, an email that required the subaddress might be less universal.

spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias.

Do they in fact do this?

Yep. I know for a fact they do.

Yahoo! Plus has a much better system where you use a different base email address plus the sub-address rather than your regular address.

For example, if my account is "somebody@gmail.com" then you use somebody+dropbox@gmail.com. But with yahoo, you pick an alternate, e.g. "huggybear", and use that instead (huggybear-dropbox@yahoo.com). That way if a spammer seems the sub-addressed account, they can't send email to huggybear@yahoo.com unless they want to end up on Yahoo's blacklist.

I've had a great deal more success with Yahoo's sub-addressing than Google's.

That's perfect, I wish you could do something like this in gmail without specifically creating a new account for every alias.

I should clarify: with Yahoo plus you only create one base for all your sub-addresses, not a new base for every sub-address.

So in my earlier example, if you wanted to sub-address ebay, amazon and hackernews you'd have huggybear-ebay@, huggybear-amazon@ and huggybear-hn@.

The big deal is that huggybear@ != someone@ and sending to huggybear@ won't reach someone@ and likely earns you a place on their blacklist (or some points towards ending up there).

Reply on news.ycombinator.com