O-  KelseyHome | File | Edit | View | Window | Special | Help

Computerized Communications

Contents


Avoiding spam with free e-mail services

Executive summary

When choosing your e-mail address, a bit of planning can apparently drastically reduce the amount of automated spam your account collects.

When posting an e-mail address, another bit of planning and explanation can mostly prevent automated systems from recognizing your e-mail address as such and sending it to the spammers.

When using such a disguised e-mail address, you must parse it and restore it to a useful state.

Full explanation

Recently I read an article on how to avoid receiving offensive and otherwise unwanted "Occupant"-type e-mail in your free* e-mail box (Yahoo, HotMail, Juno, etc.). A brief experiment coincident with Cindy's need for a new free account seems to have proven the article accurate to at least some degree. Here are the facts as we think we see them. *Note that it't possible--even likely--that it all applies equally to a non-free account, except that some services won't permit you to choose your own user ID.

It seems possible for spammers to send e-mail to addresses they don't actually know. I'm not certain of the all of mechanics, but I have seen it myself--it seems to involve computer-generated speculations. Once they know a domain name ("yahoo.com"), their computers can place bets, as it were, on the existence of individual accounts named "asmith", "bsmith", "csmith", etc. The bets are extremely inexpensive, because the misses cost nothing at all, and because spammers frequently hijack computers and e-mail accounts belonging to others to do the actual work.

What the article alleged is that the simple addition of a number somewhere in your user ID may cause it to fall outside their program. It seems to work.

We set up a new Yahoo account for Cindy (before having read this article), and it immediately filled with offers to help her do things that aren't actually possible for her to do, offers to provide her with views of things she has no personal interest in viewing, and offers of interactions with people she had no interest in interacting with. Pretty sleazy stuff, all in all. 

Yahoo does provide a system of filtering, but before trying to learn it, we tried something else: We made another new account, this one with a number in it. Shazam! No spam at all! Originally for an unrelated reason, my Yahoo ID has always contained a number, and it has never collected any significant amount of spam. 

That's why our accounts have numbers in them. 

So, "kelsey2277@aol.com would be better than "kelsey@aol.com" because a "robot" generating hypothetical e-mail addresses would have to walk through 2,276 combinations of "kelsey" and a number before bothering me. "kelsey2277bumpkin" would be even better because the extreme unlikelihood of hitting upon the triple combination.

There are ways for spammers to get our real e-mail addresses, without resorting to guessing:

  1. from web pages that contain them; 
  2. from our own postings to newsgroups, discussion lists, and bulletin boards; and 
  3. from our online activities such as ordering goods and services online (by acquiring addresses in batches from the people with whom we have done business, as has always been done with addresses and telephone numbers).  

#1: For a time, web pages I managed were "hidden" in a small way, to keep them from being exposed to the "spiders" and "bots" that cruise around on the Internet looking for e-mail addresses to report to their owners. Over time, this simple measure has broken down, so perhaps I need to try something else. (Ranger officers and organizers who would like for me to protect their e-mail addresses can contact me about increasing security.) One method would be to disable automated links and substitute graphics to represent such addresses. Potential correspondents would then have to type in eddresses.

#2: Obfuscating Eddresses: 

To prevent automated systems for "harvesting" e-mail addresses from web pages and other Internet content, some knowledgeable people "disguise" their e-mail addresses when they post to newsgroups, e-mail discussion lists, bulletin boards, etc. The most common method for doing this is to insert something that must be removed before use and which is obvious to the human eye. 

So: "kelseyNOSPAM4718@aol.com" is a common, somewhat primitive, form, although I would expect that the spammers would have figured out how to automate the removal of such a common phrase.

"kelseyNOJUNKMAIL" might work for at least a little while. 

"yeslekBACKWARD" might be another possibility. 

"kelsey@AyOhEllDotCom" would work, but might confuse the reader, since it's less evident what must be done to restore the eddress to its usable state. Anything that requires human intervention is likely to serve to insulate its owner from abuse, and it's even better if the method announces itself to the human reader. Some e-mail clients can be set to automatically perform this type of disguise in outgoing mail. Give some thought to your correspondents' tolerance for the minor hassle.

Update: I have decided to adopt disguising features in the e-mail addresses I find it necessary to include on my web pages. Variations of something similar to "kelseyREMOVE666ATispDOTcom" would be what's seen by humans and eddress-vacuuming robots; humans would edit that before either using it in a message or adding it to their addressbooks as "kelsey666@isp.com". 

[ Further Information on Obfuscation ]

#3: The best way to deal with this issue may be to take out free "sacrificial" eddresses from Yahoo and such. If you use such an eddress only for corresonding with commercial concerns about business you have initiated with them, and which is likely to have an end, you can spend most of the time ignoring the existence of the account, not worring about what might collect there once your business has been concluded. When it's time to use it again, clear out the spam, if it has collected any, and put it on the next order you place online. Watch it until that business has been finished, etc. If it eventually collects too much crud to be useful, abandon (sacrifice) it and open another. Keep a good log, to avoid confusion and memory lapses.

Take out another (set of) sacrificial address(es) for use when you are required to subscribe to a service such as an online newspaper. If you cannot imagine needing to hear from them, you can just never check the e-mail from that ID/account, or arrange to have it immediately filtered to trash without appeal, or whatever.

Many e-mail clients can "filter" out unwanted e-mails based on recognizing words a message contains in its header or content. If, for example, you cannot imagine a legitimate reason for having "penis" in your e-mails (because you don't have one or because you are satisfied--so to speak--with the size of the one you do have) you could tell your e-mail client to immediately trash (or perhaps bounce) anything that arrived with that word in its subject, From: line, or content. Set up another filter for "breast" (to mention another common spam topic), and another for "viagra", and you may get rid of a ton of unwanted messages. 

Filters have their adherents, but they are not magic, and are not without real risk. If I happen to mis-type "pens" in the course of our discussion of writing instruments, my message might get trashed summarily, and neither of us would know it. In a famous case, "breast cancer" discussions triggered filters and annoyed a whole lot of people who were hoping to participate in a serious discussion. Furthermore, if one enjoys "adult" jokes, filters may interfere too much. Therefore, flagging instead of summarily discarding might be a better approach. What is even worse, though, is that for some reason spammers have decided that it's very important to get through even to those who have already decided they don't want such contacts, and so "Viagra" may get respelled as "V*I*A*G*R*A", thwarting your filter and soiling your in-box.

One filtering approach that some advise but that I dislike is to set filters to admit only e-mails coming from people with whom you are already acquainted. This technique precludes any new contacts, and it frustrates those friends and family who have found it necessary to change their e-mail addresses (or use public terminals?), or friends-of-friends who would like to contact you. The worst part of this is that potential friends might never know why you weren't responding--that you were unaware of their attempts. Furthermore, it's labor-intensive: Each new personal or business contact requires a trip to the filters list.  Altogether, the price is too high.

There are commercial packages that purport to help with the problem, but I have not investigated them. I believe it seems likely that they would suffer from all the same problems as have been outlined above, so I don't consider this an interesting line to pursue.

The Internet contains a large amount of information about how to deal with spam. I have not checked, but I expect that America Online, Microsoft, Netscape, and Yahoo all have advice and other helps on the subject. The U.S. Federal Trade Commission does, as well. (Below.) Consider consulting ZDNet and other Web sites that Google and/or your own favorite search engine might return on "stop spam" and similar phrases. Newspapers with online presences may have helpful advice and information, too. Last but not least, consult your ISP.

The whole unwanted e-mail issue might inspire us to slap our foreheads in amazement, frustration, and disgust. I hope this little bit of information might help reduce your headaches.

[ Center For Democracy and Technology | FTC^-- ]

29 August 2005


** Mark's "permanent" e-mail address

For some time, I have used a free mail service as my "portable"/"permanent" in-box. On advice from more experienced computer users, I chose one e-mail service that would be independent of my ISP (Internet Service Provider), so that changes of ISP would not necessitate asking my correspondents to alter their addressbooks--potentially a nuisance on both sides.

Results have been mixed.

On one hand, when I have changed ISP, I have been able to relax with it and avoid annoying people (myself included) with mass mailings advising of the change. Great!

On the other hand, on a couple of occasions those free services have caused that very problem themselves. When it began seeming unreliable, I changed from Seattle Community Network (...@scn.org) to Yahoo (...@yahoo.com). Now Yahoo has suddenly announced their intention to begin charging for their service (as well as for some other stuff that they had encouraged us to use for free).

I still believe in this practice, and I still recommend it, despite these "unexpectednesses". Therefore, my in-box migrates again, this time to a service provided by Apple Computer. Please accept my apology, and update your e-mail addressbook accordingly.

21 March 2002

Update: A number of free and non-free services offer this same "permanent portable in-box" convenience. Besides the question of cost, they group themselves into two categories over this issue: Access via your own e-mail client (e-mail software running on your computer (either of two "styles": POP or IMAP) vs. access via browser window ("web mail"). Many ISPs support both, because although a normal client is generally faster, handier, and more secure, a web mail service permits access when you are away from your own computer. Some of the "free" e-mail services will permit either mode of access, and may also support automatic forwarding to your real in-box.  Some (Yahoo, for example) may insist that you use their web service if you don't want to pay a subscription to get the more desirable desktop client form of access.

Note that your ISP may support multiple mailboxes, some of which could be sacrificial. An ISP probably has a limit to the number of active mailboxes permitted, but may not limit the total number established and decommissioned over the life of a subscription. They generally don't want you to get spam any more than you want to get it, because spam costs them, too.

Google "free in-box" and similar for further information.

29 August 2005

[^--]


This site is open by invitation only to the friends, family, associates, guests, and assigns of its owners, Mark & Cindy K., who maintain it for their own pleasure and convenience. It contains nothing of interest to the general public. Please do not index it.

© 1999-2008 Mark Kelsey, who accepts responsibility for everything on this site that nobody else will own up to.