Disposable email address

Disposable e-mail addressing (DEA) refers to an alternative way of sharing and managing e-mail addressing. DEA aims to set up a new, unique e-mail address for every contact or recipient. This makes a point-to-point connection between the sender and the recipient.

Subsequently, if anyone compromises the address or utilises it in connection with any e-mail abuse, the address-owner can easily cancel (or "dispose" of it) without affecting any other contact. Following the cancellation or replacement of a disposable e-mail address, the (ex-)owner need notify no more than one person/contact of the change.

By comparison, the traditional practice of giving the same e-mail address to multiple recipients means that if that address subsequently changes, many legitimate recipients will need to receive notification of the change and to update their records — a potentially tedious process.

DEA, in essence, sets up a different, unique disposable e-mail address for every sender/recipient combination, and its owner shares it only once.

Most likely, but not always, cancellation of a disposable e-mail address takes place because someone starts to use the address in an illegitimate manner. This may occur through the accidental release of an e-mail to a spam list, or because the original recipient unscrupulously and deliberately obtained it deceptively. Whatever the cause, DEA allows the address owner to take unilateral action by simply cancelling the address in question. Later, the owner can determine whether to update the recipient or not.

For the sake of convenience, disposable e-mail addresses typically forward to one or more real e-mail mailboxes where the owner receives and reads messages. The recipient of a disposable e-mail address never needs to know the real e-mail address of the user. If a database manages the DEA, it can also quickly identify the expected sender of each message by retrieving the recipient of each unique DEA. Used properly, DEA can also help identify which recipients handle e-mail addresses in a careless or illegitimate manner. Moreover, it can serve as an effective tool for spotting counterfeit messages, or phishers.

DEA operates most usefully in situations where someone may sell or release an e-mail address to spam lists or to other unscrupulous entities. The most common situations of this type involve online registrations for things such as discussion groups, bulletin boards, chat rooms, online shopping, and file download websites.

At a time when e-mail spam has become an everyday nuisance, and when identity theft threatens, DEA can serve as a convenient tool for keeping network users safe and sane.

The plus addressing technique also allows someone to create a new, unique e-mail address, for example username+companyname.checkstring@domain style addresses can function as DEAs. A checkstring, which is optional, allows the MTA to block attempts by spammers to bypass the DEA filtering. Example checkstrings: a static string or checksum one can compute in one's head and program an MTA to compute, such as with a sieve or procmail script.

The Downside

Many forum and wiki administrators dislike DEAs because they obfuscate the identity of the members and take member control away from them. As an example, if a Troll uses a DEA they cannot be effectively banned. They simply reapply with a different DEA. Likewise, in the case of a wiki vandal. For this reason, SMF and other forum software have facilities in place to ban DEAs. This is also becoming a problem with wiki-vandals and may, in the future, result in the restriction of DEAs in wiki sites as well. In order to re-balance this sad state of affairs, those operators are also disabling the publication of members' email addresses. This protects them from spam and allows them to use real email addresses. This in turn gives back a measure of control to the forum or wiki operator.

Between vandals, spammers, crackers, and thieves, there is no real good solution except developing a careful framework of personal use policies. DEAs are not a complete answer. Where a forum or wiki prohibit publication of member email addresses, allowing email only through a member's account, with an internal client, then giving that operator your legitimate email address, if they insist on a real email address, is probably safe. If they publish or allow to be published, your email address, in any form, then they will have to accept a DEA or you shouldn't participate there.

External links

Disposable e-mail services are listed at:

• Temporary Addresses at Curlie
• http://del.icio.us/tag/email+privacy
• http://del.icio.us/tag/disposable+email
• undisposable.org: collaborative blacklist of DEA hosts.