Ask HN: Do you track how your email address is used? If you want to know when your email is sold or shared, there are several strategies to know who the culprit is. Plus addressing/subaddressing is the practice I hear about the most often, and how I keep track of email use.
Do you care about tracking your email? And do you use plus addressing or do something else? |
"if I create an account with Target called target@domain.com and I start seeing emails from Walmart sent to target@ then I know Target sold my data."
His eyes got really big and he changed the subject.
I can’t imagine spending more time on this, though.
It's also interesting that some services don't allow COMPANYNAME@mydomain.com for registration. (Can't remember which)
If I find out someone sold/shared/leaked my email what am I going to do?
Here the possible responses as I see it:
* Stop doing business with them - This is way easier said than done
* Be mad - ok, great, now what?
* Send a strongly worded email - again, so what?
* Sue them? - Good luck
Selling or sharing my email address is a shitty thing to do, but my recourse is extremely limited and really ends up with me just being angry with nothing to do about it. Given that I’ve decided just to not care.
There are many things in life that I once cared about or once got worked up about that I don’t anymore because I’ve realized that it’s just not worth it. I’ve tried to identify more and more the things that get me mad, but don’t affect any change and then purge those things from my life. Life is too short to spend your time worrying about things like who sells your email.
So if I sign up for a service like amazon.com, my email address will be amazon.com@[my-spam-domain].com so I know exactly who is selling my email address. I do this for every service that asks for an email address.
I'd never use a "plus" email address from my main email account, which is far too easy for spammers to figure out my real email address from.
Gmail has supported this for a long time with the '+' character, but this has some major problems. Many things that accept email addresses don't recognize '+' as a valid email username character and won't let you submit the form. I hypothesize that some of this is poor awareness of what constitutes a valid email address, and some of it is intentional to force users to input their "real" email address. I have also run across a few systems that stripped off the '+' suffix off my gmail address.
My solution is to use the '.' as the separator because 'firstname.lastname' is a VERY common email username and I'm happy to not allow it in a "real" username on my tiny mail host.
So every new site or company I interact with gets user.acme@example.com instead of my "real" email address. I can filter incoming emails based on the To header. And I even have a list of companies (a couple well-known) that have leaked or sold my email address to spammers. Some day I'll write a blog post about that.
Some companies want you to respond from the email address on file when you interact with them.
If I did it, I would have to set it manually. I don't know of an email client that supports setting the From header to the address in the To header of the relied-to message, but it feels like something that would be fairly easy to do as a Thunderbird plugin or whatever.
This is why I also like how iCloud does with their hide my mail feature; there’s nothing suspicious about the email you give out.
For specific vendors where I am at the shop, I just make up an alias email with their name in it.
For apps, services, I configured bitwarden to create email aliases on Fastmail, so they are linked to a service.
It gives you quite a bit of insight and control.
some examples:
- at some point my email for amazon was shared, and I started getting offers from some vendor to 5-star review one of their products on amazon. I changed my amazon email address. (I generally trust amazon)
- emails from my bank have to go to a specific email address. I can be pretty certain it is my bank contacting me.
- I generally do not give my email address to retail stores. On several occasions I've given it to them for deliveries, telling them it isn't for anything but for the delivery. I'd say 80% of stores are super disrespectful of this. One spammed me every. single. day. with offers, until I got the delivery and turned off that email address.
- I once gave out a specific email address to a friend. He shared it with a second person to coordinate all of us meeting. and then I started getting phished so we figured out that the second person had his email compromised.
- I rented a car from hertz and had to give an email address. and then they sold it to other companies.
- linkedin stuff. easy to spot fakes since they don't go to my linkedin email address. Also easy to spot emails from people contacting me who got the email from linkedin.
It goes on and on. More people should do this.
This is a neat advantage of this approach. I usually get phishing emails on a "wrong" email address, which makes them trivial to identify. So I know what to look out for should they ever manage to target the correct email address.
Every entity gets it's own email address. As others have pointed out, it lets me track who ends up with it. Sometimes I find it surprising, mostly I don't. Sometimes, though, people are up to some shit.
edit to say that those actually creating mailboxes for everything should just use aliases that funnel to a single mailbox. So much easier to maintain than having to have a huge keepass db.
edit 2 employ dmarc if you want to see who is trying really game
I wrote my own code to tie it all together, but there are tutorials that show how to do pretty much the same thing if you do some searching.
I have my email stack running on linux in a cheap VPS.
The main problem most people run into is having poor ip and/or domain reputation with the large mailbox providers. (gmail, yahoo, etc.) It takes time and not sending email that looks spammy to build enough reputation to get delivery to the inbox and avoid being sent to the spam folder. You can get an idea of domain/ip rep by signing up for google postmaster tools and entering your domain and ip or block of IPs from which you are sending. If you are lucky when you sign up for a cheap VPS you will get an IP address that does not have a bed ruputation or at least no reputation.
My setup is only for my personal, non-commercial stuff.
You could also use a setup like this with integrated with something like AWS SES in order to mitigate bad IP reputation.
edited to fix a typo
Gmail is really good at filtering spam, so I probably looked into it and found a letter that I waited for only one time in last few years. My inboxes are either empty or may get first non-spam marketing emails that I unsubscribe from immediately. Unread count zero.
Idk why people fortify their email that much and investigate who does what. Have no issues nor hesitation with leaving my work email at any local org.
I use a catch-all. I can accept (whatever)@mydomain.tld
Anytime a new company wants my email address, I just randomly give them one.
So far I only get spam to the email addresses other people posted on a website as contacts for organizations I volunteer with.
(I get spam from web scraping, not from company hacks/sharing etc.)
Do you get so much spam from a specific email that you feel safe to ban it completely? Are you able to sue them or just send a strongly worded email about how they sold your email?
Now I know where the spam (I get) comes from.
I haven't had to ban any addresses yet.
I also once helped a seller discover that their contractor had stolen and resold their customer contact list when I started getting unrelated spam at that address and complained lol
Of course, the vast majority of spam I get is marketing emails from companies I've actually done business with. Few if any even have an opt-in checkbox on their checkout form and those that do hardly ever honor it. There's simply nothing to be done about that except unsubscribe after the first time they spam you - and this is where having unique emails also helps, because those "unsubscribe" links are obviously riddled with tracking as well.
Most people who work in the 'email marketing' space know about this feature. So it's common to see people recommending clients to 'clear' their email list before sending unsolicited emails. And some services even offer this as a feature in the platform.
And that also goes for custom domains hosted on gmail. You only need a MX query to learn who is responsible for mail handling in a specific domain.
Curious why this matters? Let's say you know abc@foo.com is hosted on gmail, so what?
Of course if unknown@spammer.net write to my amazon-cx1@mypersonaldomain.tld I could try to locate who have sold/leaked my address but it's still vague, since Amazon, eBay, PayPal, have a gazillion of third party. If it's to JoeIKnowNothingAboutIT@maypersonaldomain.tld it's likely he was cracked and so on.
I found that despite what people think, your e-mail address isn't being sold. At least, not by any vendors with a remotely decent reputation. I never got spam to any of those e-mail addresses.
I've seen it as fast as 24 hours my unique email address is being used by others even though their privacy policy says that they will never share your info.
Beyond that I don’t worry about this too much.
As a side note - amazed that iPhone autocorrect corrected my “owned” to pwned in above
I don't think all or most of these companies on the list are intentionally selling my address to spammers. I suspect most of these leaks are due to poor handling of the data or server compromises. (Surely Adobe, for example, isn't so desperate that they would sell my address to spammers.) But whether by malice or incompetence, I can easily block them.
I have no idea if this works the way I expect it logically could or should, but if it does I guess I have some data to go thru.
My message stats: You have 245 spamgourmet address(es). 827 emails forwarded, 28,605 eaten.
The #1 worst offender for selling my address was Yahoo, followed by the German magazine Der Spiegel, then Groupon. But my stats go back 20 years, so this may not represent current sharing activity. I also have many many examples of registering at all kinds of sketchy websites that have never used that temp address beyond the initial registration confirmation..
Sorting by created date, in the most recent 5 years, my temp addresses seem to be getting shared and re-used considerably less frequently, which probably correlates to the overall death of email, which is for old people, so I am told.
Because yahoo also hosted @yahoo addresses, it would have been pretty noticeable if they sold the addresses of their own users.
"EDIT:which probably correlates to the overall death of email, which is for old people, so I am told."
Still alive and kicking as the de facto passport of the internet.
Addresses which have been lost/stolen and start receiving spam become spam traps, and I change the email address with the company/service to a new alias so their legitimate mail is delivered normally.
In some of the few cases where the loss/theft was identified, it didn't happen at company/service directly, but with one of their suppliers, for example, a breach at the marketing email provider they used.
For instance, if you look at the article he wrote about CBBS[1], you'll see he's listed at apartment #3D.
I never took up the practice, though I suppose I could having the warot.com domain to play with, and a single family residence to make up PO boxes, apartments, etc.
[1] https://vintagecomputer.net/cisc367/byte%20nov%201978%20comp...
Then, if I receive some spam messages, I can delete an alias that I don't want, in order to avoid receiving any messages.
(When someone sends to an invalid alias, the SMTP server gives them a 550 error.)
(I use Heirloom-mailx for reading, managing, and sending email messages.)
The most shocking thing was that I was calling them regarding an issue in which they required me to prove my identity, and yet the person I spoke with didn't seem to be well versed in security measures.
Also: I use a separate alias for every company (and sometimes individual) I deal with. In the 25 or so years I've been doing this, so far I'm up to over 1,000 aliases.
ROT13 or the date in base36 (to keep it short) might help when you need to spell your email address over the phone. Today is oaf@example.com.
I will update my technique to use incorporate this method, thanks!
There are people that will read an email from "SamsungCeo@gmail.com" and think it's actually from the owner of the company...