this post was submitted on 28 Sep 2023
54 points (100.0% liked)
Privacy
31815 readers
330 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Probably not.
The best advice I've heard is to use a variation of your email (assuming you use Gmail) on every site you sign up for that indicates that website. This would allow you to immediately know.
More info
Scammers are well aware of this trick and can easily strip out everything between the + and the @ on a huge database of email addresses. A better approach is to use Proton Pass or simplelogin, which creates a brand new email address that forwards to your real one. That way you can create a new email address for every site. Both services automatically append the site name and incluse a few random digits to the new email address. So if you want to make a new alias for your LLBean login, it'd create LLBean.gv4gk7.passmail.net which would forward all emails to your real email address.
Why would a scammer care if you figure out which 3rd party sold you out? I don't think the risk is worth paying for another subscription.
Because after you setup the filter to remove that plus sign label, your email address is worthless without removing it.
Why would it be worthless? It's still a valid, deliverable address to a real person (you). The only difference is the receiver knows which company sold their information AFAIK
No it's not, because the whole point of it is so you can filter them out. Which is exactly what you do when you realize you're getting email from someone you didn't give that address to, and at which point it becomes worthless. But stripping out the plusses is trivial and yields an un-filterable address.
Does something similar exist aside from Gmail? Cus you know. Gmail.
I think it's a fairly standard feature. At least Protonmail also supports this kind of "alias".
If I'm not mistaken it's part of the original spec, Dylan beattle had a bit in a talk about email at some point
Edit: I was in fact mistaken it's a Google only thing and not part of the spec
You could use something like simplelogin.io to create aliases.
Integrates with password managers like Bitwarden nicely to generate aliases.
I think many other services support the + trick though too. The downside is that spammers know the + trick and can find out your base email easily; they can’t if you use an alias.
Protonmail supports + addresses as well. Not sure about others.
YMMV on all of these. These are things I use or have considered.
Afaik this is not a feature unique to Gmail, it's a feature of the email system as a whole. Same with a dot. Any characters after a plus or dot in the first part of the email are ignored.
I'm fairly certain you're wrong about the "." in an email address
This breaks a lot of sites that try to sanitize addresses (don't ask me why they do it)
Had it happen a couple of times that I would register and then it wouldn't recognize my email for the login or the confirmation email would never arrive. Never tried it again after that because it also ment I was unable to use that email for that site as well.
more than that, dots don't matter in gmail. bill.gates@gmail.com is the same as billgates@gmail.com, or as b.i.l.l.g.a.t.e.s@gmail.com. they all funnel into the id with which yiu had signed up.
this allows you to put various permutations of your email id for varioua online services.
I do this with passwords, too. For example, generate 15 digits and add 5 digits (like +LMY!) to end. Many of those sites will list which passwords were stolen, easy to see to see which sites have unforgivably poor security.
For email addresses, the variation is useful, but it's probably inevitable that it's eventually sold, stolen or guessed. Still nice to have the evidence.