How to use the Bitwarden forwarded email alias generator(bitwarden.com) |
How to use the Bitwarden forwarded email alias generator(bitwarden.com) |
Edit: Is there a standard or API spec perhaps across email alias services for generating, listing, managing, and invalidating aliases?
(happy paying bitwarden customer, no other affiliation)
You can do it in Office 365 but it's tedious, you have to add the alias and then you can email from it.
[1]:https://www.hetzner.com/webhosting/
I am not affiliated with Hetzner.
https://relay.firefox.com/faq/#:~:text=can%20i%20reply%20to%...
A separate domain can be used if really needed. But even with using my own domain, I don’t see it as a problem. After all, emails are not anonymous, and a leak with an alias with a custom domain is still meaningless and doesn’t affect other services.
[1] https://support.apple.com/guide/iphone/create-and-manage-hid...
I would love to see aliases being promoted more and more by companies. In the end most companies want to get in touch with you via e.g. a newsletter. So why do they need exactly your private email and not just an email alias. In the end they're reaching the same person.
1) Prevent duplicate account creation
2) Users forget what email they used to signup (this happens ALLLLLL the time with + emails)
3) To sell your data, link you, and spam you.
This is the same idea but for their email identity.
The more places you use the same email address, the greater your exposure.
In fact, given it seems to just put a random string in front of a domain name you give it I'm a little curious as to why they need your API key at all - is it just to ensure that you are not creating duplicate email aliases?
It's not just making up a bullshit address, it's generating a random localpart then going to the email forwarding service you've integrated and having that service create an email forward to your real address per whatever settings you have there.
Any email sent to the address it generates (signup confirmations, password resets etc) need to get to you, after all.
This design is completely different to using <business>@example.com. The latter is kind of useful for your use of 'who has sold my address' but has privacy drawbacks this design doesn't. e.g. if a spammer gets bestbuy@exmaple.com they know you prob also have twitter@exmaple.com, facebook@exmaple.com or whatever else and it's all just the same guy with the same inbox.
Truly 'random' addresses at generic forwarding services means that if Ashley Maddison gets breached again then your secret remains safe. sj4h3bd@forwarder.net could be anyone.
Fair enough - the one I use automatically creates an alias whenever it receives an email at the relevant domain so there's no need to manually create one, I assumed the other services were the same.
The Addy app has a utility to generate this, too.
So while it's tempting to use one random alias (h3hj4gjh234@yourdomain.com) for a high-risk service and another alias for a critical service (github@yourdomain.com), these aliases are easily identifiable as belonging to the same person.
That’s good to know, thanks!
Spammers simply obtain lists of emails through hacking or purchasing them and then spam them, they don't pick a particular address and modify it.
But as a counterpoint it literally happened to me to me years ago when I used to use name+<service>@exmaple.com. I got cold emails to 'name+paypal' despite never, ever having used that localpart. I've no doubt it was absolutely targetted and not a hit-and-hope spamblast but it was enough of a wake-up call for me to realise it couldn't really be relied on.
I used similar (well, plus addressing with localpart=name+<service>) a long time ago and once got emails to name+paypal@example.com even though that was a suffix I'd never used. Some enterprising person out there had obviously obtained one or more of my service-specific addresses and was trying to game my attention by changing the identifier to something 'important'. That's when I personally ditched the approach.