[HN Gopher] Tmpmail: Temporary email right from your terminal wr...
___________________________________________________________________
Tmpmail: Temporary email right from your terminal written in POSIX
sh
Author : thunderbong
Score : 142 points
Date : 2024-08-14 14:03 UTC (1 days ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| vessenes wrote:
| Love this. Nota bene, it uses 1secmail.org's API on the backend.
| Still love it.
| xelxebar wrote:
| Started running my own email server about 10 years ago for
| essentially this use case. Every entity I need to give an address
| to gets a unique, randomly-generated one. I figured this would
| let me spot the leaks.
|
| After roughly 1000 addresses handed out, surpisingly only two
| sources end up receiving spam: 1) addresses that I've posted on
| public forums, and 2) the address I use for patches to GNU
| software.
| nobody9999 wrote:
| >Every entity I need to give an address to gets a unique,
| randomly-generated one. I figured this would let me spot the
| leaks.
|
| I do the same, except I don't use a randomly generated address.
| Rather, I use something that identifies who it is. e.g., if I
| had a relationship with Tesla, the email address would be
| 'tesla@myemaildomain'.
|
| What (if anything) is the advantage of using a randomly
| generated email address over the scheme I use?
|
| N.B., I'm not dissing your strategy at all. I do exactly the
| same. I'm just curious about the "randomly generated" bit.
| jmuguy wrote:
| I would guess just speed of creating the addresses/not having
| to worry about using same address twice accidentally
| dasyatidprime wrote:
| Not the parent commenter, but I've encountered "people from
| the counterparty organization get confused and wonder whether
| you're part of it too / pretending to be part of it too".
| This can be mitigated with some obscuring transformation.
| nobody9999 wrote:
| >Not the parent commenter, but I've encountered "people
| from the counterparty organization get confused and wonder
| whether you're part of it too / pretending to be part of it
| too". This can be mitigated with some obscuring
| transformation.
|
| A fair point. Thanks!
|
| Personally, I can't be bothered and when (not if -- the
| scenario you've outlined has happened with me) folks get
| confused, I just explain that I do it to fight spam and
| they generally just nod agreeably. Whether they get it or
| not isn't my concern -- knowing whose user database has
| been pwned is.
| xelxebar wrote:
| When I started, I wanted the addresses to look as innocuous
| as possible in order to avoid unnecessary explanations.
| Filling out paperwork that people hand inspect is one case
| where that can cause issues. I have also heard of people
| getting filtered as potential spam accounts when the email
| address matches the service name or whatnot.
|
| Anyway, I just use pwgen to generate plausible-looking
| addresses: pwgen -A0 10 1. They often look like realistic
| abbreviations of names.
| nobody9999 wrote:
| Thanks! It makes sense, but I'm too lazy to bother.
|
| I haven't seen my email get filtered, even after more than
| a decade, but I suppose it could happen.
|
| If I do run into something like that, I can always fall
| back on pwgen. Thanks again!
| rsync wrote:
| "I have also heard of people getting filtered as potential
| spam accounts when the email address matches the service
| name or whatnot."
|
| I have heard of that as well but many years in I have not
| experienced it.
|
| I do the same thing the person you are responding to does:
|
| nameofservice@domain.com
|
| ... and they all just go to my inbox with a descriptive tag
| in the subject that I insert with procmail.
| Z7YCx5ieof4Std wrote:
| > I do the same, except I don't use a randomly generated
| address. Rather, I use something that identifies who it is.
| e.g., if I had a relationship with Tesla, the email address
| would be 'tesla@myemaildomain'. > I almost use the
| methodology except I add ramdom characters at the end.
| Tesla.ahcdk@domain.com
|
| Reasoning is that its most likely if you have tesla@ you will
| have facebook@ tesco@. When adding characters you can filter
| on the . + 4 characters
| GoblinSlayer wrote:
| I heard facebook doesn't allow emails with "facebook" in
| them. Alternatively you can give facebook.te@ address to
| tesla and tesla.fb@ address to facebook, nobody will figure
| it out :)
| nobody9999 wrote:
| >I heard facebook doesn't allow emails with "facebook" in
| them.
|
| Where, exactly, did you hear that?. I can confirm that's
| not the case.
|
| My FB email address is a bare 'facebook@myemaildoman' and
| hasn't been a problem. Ever.
|
| That said, I set that as my FB email address more than a
| decade ago, so I guess things may have changed since
| then.
| nobody9999 wrote:
| >Reasoning is that its most likely if you have tesla@ you
| will have facebook@ tesco@. When adding characters you can
| filter on the . + 4 characters
|
| I get you, and it's a good idea if you're using someone
| else's domain (e.g., gmail.com, protonmail.com, etc.) to
| make sure you have a unique email address.
|
| Since I own -- and host my own domain for my emails (as
| does the OP, IIRC), that's not necessary, as the domain
| name itself makes the email address unique -- since I'm the
| only one who uses it. As such, I can (and do) just filter
| on 'facebook', 'tesla' and 'tesco' directly.
| ForOldHack wrote:
| I cannot thank you enough for your contributions to GNU.
|
| I always use the dingleberry subdomain that goes nowhere,
| except when an actual human interviense. Goes straight to the
| bitbucket, and 1 out of 10 gets a pervue to see if I need to
| add the source to my reject list which my ISP keeps peeking
| into for changes to their reject list.
| JOnAgain wrote:
| The real value of this, IMHO, is that it makes it much harder
| to match you against services and in ad platforms. Hashing
| email addresses is the primary way user data is exchanged.
| Szpadel wrote:
| I use self hosted anonaddy instance for such purpose and have
| dedicated alias for each registration.
|
| It forwards received emails to my main mailbox with added
| header telling me source email with note about where I used
| that address.
|
| that way I discovered few sites that were bought by some entity
| and that sold my email to some crypto 3rd party
| mvelbaum wrote:
| 1. does anonaddy support ARC?
|
| 2. are you able to reply to the email?
| Szpadel wrote:
| 1. In case dmarc is not passed you get extra red banner
| with warning to forwarded email
|
| 2. Yes you get special email to reply-to field that allows
| sending from alias, but you have to make sure you remove
| included banner containing alias deactivation URL from
| quoted part of reply. You can disable this header but in my
| case I needed to reply only few times
| alchemist1e9 wrote:
| I've recently been the target of many attempts to hijack my
| gmail account, including even phone calls with live agents
| impersonating google "security team". Successfully hijacking my
| gmail address could be catastrophic for me and others I assume.
|
| Anyway I was wondering if self hosting an email server might
| allow for a security layer for those of us sophisticated
| enough. Especially if we own our own domain. Ideally my email
| address with access to financial services would have 2FA to
| both read and send emails for example. Don't even think there
| are clients or protocols but perhaps with self hosting this can
| be rigged up with various tricks like port security opening
| only with a 2FA message.
|
| I'd be curious what other perspective on this issue is.
| jamal-kumar wrote:
| It's a decent amount of upkeep and cost, but I get paid do it
| for a bunch of clients who desire this for their companies
| and have my own which is humming along great. If you go the
| route of a script to set everything up I found iredmail to be
| the most mature and reliable solution, even if the upgrade
| path is super manual at least it gives you a chance to know
| at what point things went wrong rather than having to pour
| over logs to fix something broken that is running in
| production. It also pairs nicely with open source failover
| solutions and if you need enterprise support they're
| extremely responsive. Bonus points for getting it working
| with your phone for backups of contacts, calendar and notes
| with CalDAV or whatever to really decouple yourself from
| cloud services with shady terms (I had to pay for an app on
| my phone for this to really work, but it works great).
| Setting your whole mailserver up manually is also an option ,
| but be prepared to sink like a month of time into learning
| how the hell to do that. This is technology from the 1970s
| with a ton to get it working in the modern world after all.
|
| Just be wary that you'll have to upgrade kinda often. I keep
| subscribed to github alerts for iredmail as they're really
| prompt about notifying their customers when they need to
| patch security holes.
| alchemist1e9 wrote:
| That's very helpful. Thank you.
|
| Who do you recommend as a very secure registrar?
| xp84 wrote:
| A perspective I've read on this (Granted, this was at least 5
| years ago) was that it was paradoxically much harder to
| compromise a Google account than it is to hijack a domain
| from many registrars. I read an account by someone who had a
| custom domain and the attacker had social-engineered the
| registrar into allowing him access, then he proceeded to
| update the MX, directing the email into the attacker's
| server.
|
| This probably varies from one registrar to the next, and
| hopefully all have stepped up their game somewhat since that
| time, but it left an impression on me and caused me to update
| a lot of my accounts to my Gmail. Obviously, nobody is going
| to be able to call into a customer service desk and talk them
| into updating the gmail.com MX record, so for someone to
| illicitly gain access to mail sent to <me>@gmail.com either I
| have to be pwned myself (leaked a credential somehow) or
| there has to be a global 0-day exploit affecting it. In the
| latter case I am personally willing to bet that mine would
| not be the first one (or even in the top 10 million) accounts
| that the hackers would try, so I sleep pretty well.
| alchemist1e9 wrote:
| I understand. For me this raises the question of who is the
| most secure and reliable registrar for a US citizen. The
| security of a self-hosted approach appears to be determined
| by the security of the MX records, the self-hosted server
| security, and the IP security of the server.
|
| With the increasing authoritarian tendencies of governments
| it seems worth considering since they can clearly pressure
| the big tech companies to access or hijack your email
| address.
| nobody9999 wrote:
| >The security of a self-hosted approach appears to be
| determined by the security of the MX records, the self-
| hosted server security, and the IP security of the
| server.
|
| Don't forget DMARC/DKIM/SPF. They're necessary these days
| as well.
| alchemist1e9 wrote:
| Definitely and I assume learning all of those will
| provide enhanced security layers also.
|
| I'm looking into MarkMonitor as a registrar with advanced
| security systems.
| dredmorbius wrote:
| I've lost several Google accounts through excessive
| authentication requirements with no viable alternatives.
|
| Fortunately I'd anticipated such issues and largely
| abandoned the platform.
|
| I have one account which I care about somewhat. I have to
| remember to log into that at least once per year to retain
| it or it will also be lost.
| dredmorbius wrote:
| The last time this happened:
|
| <https://toot.cat/@dredmorbius/111105389290062668>
| alchemist1e9 wrote:
| So what is your secure email approach? Any thoughts on
| this problem would be interesting.
| alchemist1e9 wrote:
| I'm looking into MarkMonitor as a possible registrar with
| extreme security features.
|
| I think gmail is very dangerous they can delete your
| existence by accident and they don't even have a human to
| contact.
| singron wrote:
| I do the same, and the only leak was target giving my email to
| a pork-related class action lawsuit.
| dspillett wrote:
| _> surpisingly only two sources end up receiving spam_
|
| Quite a few of mine get junk:
|
| * A couple that have been subject to leeks or hacks, that I
| haven't got around to changing yet (linked-in for example)
|
| * A fair few were given to businesses that are no longer in
| operation (hosting providers, online stores) who presumably
| sold their contacts databases to make a few pennies before
| finally closing up
|
| * Also some junk senders seem to have worked out that the sub-
| domain I use for the per-entity addresses is a catch-all, I
| need to address that at some point.
| data_maan wrote:
| > Also some junk senders seem to have worked out that the
| sub-domain I use for the per-entity addresses is a catch-all,
| I need to address that at some point.
|
| Could you elaborate how you'd address that?
| dspillett wrote:
| There are a few options I've thought of, including these
| ones off the top of my head:
|
| 1. Just enable each on first use, instead of using a catch-
| all at all, though there is a danger there of bounces due
| to mistakes on my part.
|
| 2. Keep the catch-all but send to a junk folder unless the
| destination address is on a white-list, this has the
| advantage that if I forget to add the new address (or do it
| incorrectly) no mail is lost as I can move it out of junk
| after the fact (as long as I notice within 30 days).
|
| 3. Generate the addresses either fully or as <picked-
| portion>.<truncated-salted-hash-of-that>@sub.domain.tld, so
| ea588e3be96e89.8177be49@sub.here.com or
| SomeShop.499ec679@sub.there.com, and use programmatic
| filtering to decide where the messages go (junk unless the
| hash matches). The disadvantages of that are needing to
| have access to the generator at any time I need an address,
| difficulty giving addresses verbally (there would be
| transcription errors), and it does nothing for existing
| addresses.
|
| Option 2 is probably the winner there.
|
| Every now and then I think of another option then dismiss
| it as overcomplicated or otherwise not workable.
| sam_perez wrote:
| Hah, that is much fewer than I would have expected.
|
| Too bad you can't do the same with phone numbers.
| ForOldHack wrote:
| Imagine a threaded mail reader with this feature from say, 1987?
| I would pay for a threaded HN news reader.
| nextos wrote:
| Gnus is not too far from that if someone maps HN to NNTP.
|
| I think there are some HN to NNTP bridges available.
| xelxebar wrote:
| After trying a few different CLI mail clients---mutt/neomutt,
| s-nail, etc.---I've come to love the approach of mblaze[0],
| _i.e._ just a collection of commands to interact with maildirs,
| which can be separately managed by OfflineIMAP or whatever.
|
| I'm curious how mblaze+offlineimap compares to other similar
| setups: nmh[1], fdm[2], and getmail.
|
| [0]:https://github.com/leahneukirchen/mblaze
|
| [1]:https://www.nongnu.org/nmh/
|
| [2]:https://github.com/nicm/fdm
| rakoo wrote:
| Shameless plug because tpis is also my approach: combine with
| fzf and a few shell scripts and the sky is yours
|
| https://sr.ht/~rakoo/omail/
| nonrandomstring wrote:
| Nice use of Unix philosophy and some well said things about
| why. Thanks for sharing these.
| rakoo wrote:
| Thanks !
| user3939382 wrote:
| I wish there was a CLI imap client with a conversation view as
| seamless as Fastmail or Gmail. I found mutt to be very clunky.
| katzinsky wrote:
| Have you tried using threads in mutt? Having them collapse by
| default seems to reproduce what I remember the gmail
| experience being.
| tetris11 wrote:
| gnus was pretty good for conversation chains
| rakoo wrote:
| Try sup: https://github.com/sup-heliotrope/sup
|
| or its spiritual successors based on notmuch
| jonstewart wrote:
| I thought from the headline this was about _sending_ email right
| from the terminal, and I thought, well that's easy, just telnet
| to sendmail on port 25 and say HELO.
___________________________________________________________________
(page generated 2024-08-15 23:02 UTC)