Show HN: Chrome extension to add random hash to email addresses(chrome.google.com)

2 pointsby svdevor 7 Jahren4 comments

chrome.google.com

Show HN: Chrome extension to add random hash to email addresses

https://chrome.google.com/webstore/detail/mail-hash/njjpbfibgmkogjbfkafflpodelhchfaf

4 comments

svdevor 7 Jahren

Op here.

Mail Hash is a little Chrome Extension to add a random string to an email address as an attempt prevent reusability for automated attacks in case a service get's hacked. Targeted attacks at specific addresses should be more difficult aswell, since an attacker would need to guess the random string you used for other services.

You can use plus addressing for providers that support it, e.g. [email protected] --> [email protected]

Or use a custom domain with catch-all filter, e.g. example.com --> [email protected]

Code lives on GitHub[0] and the extension can be downloaded at the Chrome Web Store[1].

I'm happy about any kind of feedback.

[0]: https://github.com/jsvde/Mail-Hash [1]: https://chrome.google.com/webstore/detail/mail-hash/njjpbfib...

MorrisofOrangevor 7 Jahren

Op really cool idea. One issue and two questions: Issue:if someone got a password list, they clean it up by removing anything between the + and the @ so it dosent add too much protection Question1:if I get an email from someone addressed to a hashed address, could I easily figure out who I gave that email to? Question2: will you be porting to Firefox?

svdevor 7 Jahren

Thanks for the feedback!

Regarding the issue I fully agree with the answer of luckylion.

Q1: Since it almost has to be used in combination with some sort of password manager, you could compare the hash with the service you signed up for. But that's a bit inconvenient. Since you receive a mail for each new signup, maybe set up a mail filter, that gathers all first mail to a hash in a dedicated folder. This way you can compare the sender with the first mail for specific hash when receiving new mails. This would have the benefit to have the data right inside your mail app of choice.

Q2: Just ported to firefox thanks to your suggestion: https://addons.mozilla.org/de/firefox/addon/mail-hash/

luckylionvor 7 Jahren

Not OP but removing the hash will not really help, even if you've used the same password on multiple sites, because the attacker would need to know which hash was used to sign up for other services.

Compromised [email protected]:mypassword won't help getting into my account at somewebsite that is registered to [email protected]:mypassword.

And, I suppose, it forces you to use a password manager, because there's no way you're remembering the email, even if you're using the same password ;)