Spyke

Syndicated from the fediverse. Read and engage on the original instance.

View original on lemmy.sdf.org

If using custom domain e-mails, to prevent spam, is it necessary to make addresses unpredictable (e.g.: stem-chaos-stricken@domain), or is servicename@domain good enough?

Assuming a password manager is used, even jfav0ohjau4gvncgan19@domain should be OK.

On the other hand, I might just be overthinking it. It could even look suspicious to customer support, or is that again just overthinking?

Also, there already will necessarily be some predictable ones, such as work@domain, although servicename@domain would provide even more possible matches.

View original on lemmy.sdf.org
20

16 replies

I use both. For most services I use the service name in the email address. It's for me, not them. I get to see who its from, who sold my data or got breached, or who got bought and changed their name. If I ever need to tell it to a real human they always think its odd and I simply say, that's how I prevent spam and they light up because they are jealous I have zero spam (maybe 4 or 5 in the past 7 years and most went to my catch all)

For smaller services like my local pizza place, I use a randomized alias (I still put their initials in it to help identify it). The reasoning is that I have absolutely no trust that they have any kind of security on their website or janky payment platform, and I highly expect massive ad tracking from that platform. Side benefit is using burner email and phone number let's me reuse one time coupons.

2

I use both formats. Mostly the one with the added random suffix, though. If somebody were to figure out that my domain is an alias and I used only non-obfuscated aliases, it would be easy to figure out how my aliases for the other services could look like. Adding a suffix makes it impossible to guess. I sometimes use aliases without suffixes if I want them to look better to the recipient, or it's an alias of more importance to me, or if I need to remember it more easily, etc.

2

You'll regret it the first time you have to read it over the phone to someone. Every letter and number repeated and re-repeated only for the email you expected to wind up in jfavOOhjau4gvncga19@domain (which you should probably be able to see). The computer database you didn't want to have it got it right on the first, and all subsequent tries.

2

which you should probably be able to see

I've heard (from one person on the internet) some servers might scan for presence of catch-all by sending e-mail to long random string e-mail at the domain, and then potentially sending spam to anything if it doesn't get rejected.

1

It doesn’t seem to matter much, in my experience. I’ve had my own domain for a couple of years now, utilizing Proton. It could be their filters are just that good, or that my addresses have not really “leaked” yet.

If you are considering using a custom domain, keep in mind that if you want to keep that email address, you will have to keep paying yearly for that domain. In addition to my monthly Proton subscription, I’m paying about $50/year for the domain. I don’t mind paying for it though.

2

[email protected] won't actually prevent spam, it will just give you the grim satisfaction of knowing which service leaked. I used that pattern for a few years and the only thing it was ever really useful for was figuring out that a service I signed up for years prior had changed their name or used a third party service to handle portions of their site features.

If you're careful about what you sign up for, spam shouldn't really be a concern. The places you're most likely to get spam from are your contacts email getting compromised, sketch online services that go out of business, and big services outsourcing marketing. Just be sure to religiously unsubscribe from any promotional materials because the longer your email remains contactable on a list, the more likely it is to be shared/sold by some shitbag marketing firm.

5
CompactFlaxreply
discuss.tchncs.de

Compactflax.myfitnesspal@domain gets a TON of spam.

other than that it’s actually surprising how little I get.

But damn that leak went far

4

Spam is thankfully pretty much a thing of the past. I had to stop using a couple of my primary emails because they were just getting drowned in spam, like a hundred messages a day if not more.

Then Sender Policy Framework came out, which went a long way to reducing spam, then came DKIM and DMARC and it's now really down to very manageable levels, and I've been able to start using both those email addresses again. They do still get some spam, but no more than 1-3 a day now.

2
lemmy.blahaj.zone

I think using servicename@domain would be fine, the common ones like support, webmaster, etc.. are the ones to avoid. And using a unique one per service helps when a service inevitably leaks that email address, you can just change it and block the old one.

6
taco_shale032reply
lemmy.ml

I actually used to use [email protected] but decided to switch because of a few reasons:

  • Using the name of the service as username can make it obvious it’s an email alias and also that the domain is (probably) used by a single person
  • In addition to that, from a security standpoint, it may make it easier for bad actors to get access to your accounts because the email address reveals which service it belongs to

Depending on your threat model, it’s worth considering [email protected] instead.

Edit: formatting

8

and also that the domain is (probably) used by a single person

Currently I am just going with namesurname.tld. If they already know who I am, it doesn't show anything extra. If it's something I don't want linked to me that easily, I can just give it e-mail on some shared domain, and change it later if needed. Though that removes the easy portability.
I'll probably have more domains eventually.

2
lemmy.world

Most spammers aren't reading the list of emails and thinking about it, they're just buying a huge list of emails and spamming them unthinkingly. I've been doing this (putting the company name before the at) for most of this century and the span contagion never spreads to other addresses at my domain.

2

Most spammers aren’t reading the list of emails

With LLMs they don’t have to. I don’t really see a good reason to use [email protected] personally, you’re giving away more information with little to no benefit compared to [email protected].

1
rollinreply
piefed.social

Don't you think you're overthinking it? Or did any of your reasons ever come true, so to speak?

When would it be a problem if someone deduces that your email domain is your own personal one?

For your other point, do you mean that someone gets access to your email - they actually break into your inbox. If they see you have a mailbox called [email protected], they'll know that's going to be the signup you used for service.com. Is that what you're referring to? Doesn't seem like a big cause for concern to me, so am I missing something?

2

I’ve been hacked before, luckily nothing severe happened but ever since then I’ve taken stuff like this a lot more seriously.

Let’s say I use a self hosted Addy instance, a bad actor knowing that my email is for email forwarding could assume I’m running Addy, which uses PHP, try the recent php2shell vulnerability and potentially execute commands on my server.

I was thinking of a data breach where it may not be obvious or mentioned which service it’s for, but I’m not sure how realistic that is. 🤔

Maybe I’m a bit overly paranoid, but In this day and age of LLMs I don’t think that’s a bad thing.

Edit: rewording

2

You reached the end