The Time Has Come to Ditch Email

Security Focus ^ | Thursday 1st June 2006 | Kelly Martin

[Born Conservative]

If I ever get anything about my PayPal account, and think it is remotely genuine, I NEVER use the link in the email, and always go directly to the site and login.

[zeugma]

I generate email addresses on the fly, and if I start receiving spam, I eliminate the account. Email gets bounced back because then there is no such account.

I'm glad that works for you. There are solutions out there that suit just about anyone's needs. personally, I don't like the idea of having to change my email address on a regular basis. I like my address and plan to keep it for another 10 years if that is possible.

[Jeff Chandler]

personally, I don't like the idea of having to change my email address on a regular basis.

I don't change my email address. I have had the same personal email address and business addresses for years.

When I buy something online, or register for something online, it works like this:

Suppose I want to buy a book from Amazon.com. I register with the email address amazon@myaccount.spam-stopper.net. When I signed up for Freerepublic, I registered as freerepublic@myaccount.spam-stopper.net. Any email I create at whatever@myaccount.spam-stopper.net is forwarded to one registration account. If I start receiving spam from an account I generated on the fly (by merely using the @myaccount.spam-stopper.net suffix), I know who sold my email address to spammers, and block that account at spam-stopper. Any email to that address gets bounced as if it doesn't exist. Meanwhile, I use my personal address for personal reasons, and my business addresses for business reasons, and they always stay clean.

[Still Thinking]

Actually, that's my policy too. But I do hover and discover the URL just to see if it's a phishing scam and I should just delete it or if I need to go to Paypal.

[Still Thinking]

I agree with you about encryption. I think a substantial proportion of email should be encrypted so that the mere fact of something being encrypted wouldn't be suspicious in and of itself.

Would you use a bathroom with glass walls? Why, are you doing something wrong in there? Just rhetorical questions, not directed at you, Z.

[zeugma]

I think a substantial proportion of email should be encrypted so that the mere fact of something being encrypted wouldn't be suspicious in and of itself.

EXACTLY!

This is one of the reasons Fedgov pushes against it.  

[Still Thinking]

Anything fedgov doesn't want is probably good for us serfs (and vice versa).

[TechJunkYard]

I generate email addresses on the fly, and if I start receiving spam, I eliminate the account.

I do that too, using /etc/aliases on the mail server, primarily for one-time business transactions that aren't supposed to become continuing business relationships. My "real" addys are revealed only to trusted friends.

I grew tired of disposing my e-mail addys when they got on spam lists, so I decided to run my own mail server -- the one thing the ISPs don't want you to do -- but it gives me much finer control over incoming mail. I use blacklists to filter out known spammers, and my own filters to keep out the spambots. Outgoing mail still goes out to the ISP's mail host so my stuff won't get blocked.

[root@Ralph root]# cd /etc/mail
[root@Ralph mail]# cat access | grep 'ERROR:"550' | wc -l
   2013

Wow, that's over 2000 subnets I've had to block over the years. And I do occasionally get "new" spam, maybe once every few weeks, and the origin has to be researched and added to my local filter until the blacklists catch up with it.

We have work-arounds to make the present system more or less tolerable, and there are some good minds (better than mine, at least) working on ideas for trying to tackle the spam problem. I liked the Sender Policy Framework (not Microsoft's) idea, but not everyone will cooperate on any one system.

SMTP is obviously broken and will have to be replaced eventually. It will be quite painful (like IPV6) but it has to be done sooner or later.