Get a disposable e-mail address

Windows Secrets Newsletter • Issue 72 • 2006-03-30 • Circulation: over 400,000

Table of contents

Top Story: Get a disposable e-mail address
Perimeter Scan: Unsafe at any speed?
Over the Horizon: Internet Explorer has triple security threat
Patch Watch: Gentlemen, and women too, start your testing
Woody's Windows: Changing registered owner in Windows and Office

Top Story

Get a disposable e-mail address

Every time you give out your e-mail address, you take a risk that your address will get on spammers’ lists and you’ll be bombarded with junk mail.

As a test (which I’ll describe in my Datamation column in a few weeks), I entered an e-mail address into a signup box at one of those “get a free laptop” promotional sites. In less than six weeks, the address I provided was hit with more than 1,000 junk messages — over 23 per day — and they show no sign of slowing down.

I was willing to risk my Inbox being overrun in this way because I used a "disposable" e-mail address. This is an address with a different keyword that you add for each Web site or personal correspondent. Such addresses make it easy for you to filter incoming mail into different folders, if desired. To prevent “dictionary attacks,” any mail sent to you without a valid keyword can be rejected. And, if an address you gave out is abused by spammers, as my test address was, you simply make all mail to that address bounce (as I eventually did to the promo site).

Disposable addresses let you register for free services on the Web without fear. At the same time, you get strong protection against spammers.

Protecting yourself against spammers and harvesters

My recently revised e-book, Spam-Proof Your E-Mail Address (see below), describes easy ways to encode any address you place on a Web site. This prevents your addresses from being collected by "harvester" programs. Harvesters are software bots that scour the Internet, copying e-mail addresses and adding them to spam databases. Studies show that harvesting is the most common way spammers build up their multi-million-name lists.

Keeping harvesters from getting your address is important, but you also need to protect any addresses you enter into forms at Web sites. In the e-book’s 2nd edition, I mentioned SpamGourmet.com, one of dozens of services offering disposable addresses. SpamGourmet allows you to insert an integer number up to 20 when inventing a new address. For example, I might register at Amazon using an address like the following:

amazon.20.secretspro@spamgourmet.com

In that case, SpamGourmet would accept no more than 20 messages from Amazon before deactivating the address. This number allows you to receive confirmation notices and the like, but your alias would automatically shut down if Amazon started sending you a lot of junk. If desired, you can configure certain addresses so SpamGourmet doesn’t stop at 20 messages but will forward to you an unlimited number from contacts you trust.

SpamGourmet is free but has drawbacks. Administering each address is an extra step. Also, there’s no way to log in to SpamGourmet to see your messages. You must provide a separate, valid address — one that you maintain at some other domain — in order to receive the messages forwarded to you from SpamGourmet.

After researching the market, I’ve decided that Yahoo.com’s AddressGuard is currently the best value in disposable addresses. The service isn’t free, requiring $19.99 per year. But this reasonable fee also gives you all the features of Yahoo Mail Plus. This premium account provides 2GB of storage, strong antispam filtering, no graphical ads in your Inbox, and the elimination of the promotional lines of text Yahoo tacks onto the end of its outgoing free messages.

Before I explain Yahoo’s disposable-address technique, let’s first look at an approach that doesn’t work — Google’s free Gmail.com service.

Gmail’s disposable addresses are the worst

Gmail provides a form of free disposable addresses, but it turns out to be fairly worthless. You first obtain an ordinary Gmail address, like so:

brilivings6789@gmail.com

You then build disposable addresses at Gmail by adding a plus sign (+) and a word that represents the contact you’ve given that address to. If you register an e-mail address at Amazon.com, for example, what you enter might look like this:

brilivings6789+amazon@gmail.com

Unfortunately, many Web apps reject or mishandle e-mail addresses that contain a plus sign. The plus sign is legal on the left side of e-mail addresses, according to Internet standards. But it’s an illegal character in Web addresses (URLs). Due to the confusion, many major Web sites mistakenly strip the symbol out before accepting an e-mail address. Other sites just choke, displaying nothing but an error message with an e-mail address containing a plus sign is entered.

Such well-established sites as Cingular, Bank of America, and eBay mishandle e-mail addresses containing plus signs, according to an experiment by blogger Wayne Burkett.

(Note to Windows Secrets Newsletter subscribers: You may reliably use a plus sign anywhere to the left of the at sign in your delivery address. All of our signup forms on the Web accept such addresses. Also, we encode the plus sign to make it a valid character whenever the address must appear in a URL, such as in our change-your-address links.)

Adding insult to injury, if a Gmail address that contains a plus sign is ever harvested, it’s very easy for spammers’ computers to leave out the plus sign and the characters leading up to the at sign. This automatically lets them add your true Gmail address to their spam databases.

Yahoo makes custom addresses easy

In contrast to Gmail’s flawed design, my vote for the best provider of disposable e-mail addresses is Yahoo AddressGuard. This feature allows you to create up to 500 alias addresses, which is plenty. (I’ve created fewer than 300 aliases in over five years, and I’m super-active at signing up for lists.)

When someone responds using one of your alias addresses, Yahoo delivers the message to your Inbox or to a personal folder of your choice. Here’s how it works.

1. Realname. You start out with a Yahoo ID, which you give out to no one. For example:

brian.livingston.6789@yahoo.com

You then create disposable addresses using a different basename. This is followed by a hyphen and a different keyword for each contact you give your address to. The resulting addresses look as follows:

basename-keyword@yahoo.com

2. Basename. You choose a basename that’s different from your Yahoo ID. You give out the same basename in all of your disposable addresses but a unique keyword for each contact. For example, my basename might be secretspro.

3. Keyword. The keyword you make up for each disposable address reminds you which contact you gave it out to. You’ll probably insert the brand name of any Web site that requires a valid e-mail address. If I want to register with Amazon.com, for instance, I could choose amazon as the keyword. The disposable e-mail address I’d give Amazon, therefore, would be:

secretspro-amazon@yahoo.com

Spammers who gain access to one of your disposable Yahoo addresses can’t simply truncate the hyphen and the keyword and get your valid address. If spammers did send e-mail to a truncated address, such as

secretspro@yahoo.com

the messages would just bounce, since that isn’t a valid Yahoo address.

Yahoo makes it easy. You can create new addresses as you need them, using either the Mail Options page or the Yahoo Toolbar.

Create free disposable addresses on your server

If you maintain a domain name of your own, you may be able to create your own free disposable addresses, which would be the most convenient of all. Say your domain name is example.com. You could create your own realname, basename, and keyword system, just as Yahoo does. Your e-mail addresses might look like this:

brian.livingston.6789@example.com would be your realname, which you’d never give out;

secretspro@example.com would be your basename (mail sent to this address would bounce); and

secretspro-amazon@example.com is the style of disposable addresses you’d give to your contacts.

When you receive mail that was sent to a disposable address, and you reply, your system must insert the disposable address into the outbound message’s From and Reply-To fields. The best disposable e-mail services correctly format such replies automatically.

If you don’t run a mail server of your own, or all of the above sounds too complex, Yahoo is a low-cost alternative that’s easy to set up and manage. Although you can’t automatically forward mail from your Yahoo aliases to another e-mail address of your own, you can retrieve messages from Yahoo using any POP3-enabled mail client. You can also, of course, log in to Yahoo from anywhere in the world to check for messages.

In addition, Yahoo.com is a well-established domain name these days. It would arguably be more respectable-sounding when telling people your address than trying to explain a niche domain name like SpamGourmet.com.

Some Windows Secrets readers are already using the trick I describe above. As of yesterday, 12,000 or approximately 8% of the delivery addresses in our subscriber database end in @yahoo.com. Of those addresses, 143 include a hyphen somewhere to the left of the at sign. About 1 in 5 of the hyphenated addresses, in turn, use a familiar-sounding keyword such as -brian or -winsecrets. These readers obviously made up a special address just for us — which is exactly what disposable addresses are for.

To send us more information about disposable addresses, or to send us a tip on any other subject, visit WindowsSecrets.com/contact. You’ll receive a gift certificate for a book, CD, or DVD of your choice if you send us a comment that we print.
Brian Livingston is editor of the Windows Secrets Newsletter and the coauthor of Windows 2000 Secrets, Windows Me Secrets, and eight other books.

Perimeter Scan

Unsafe at any speed?

Ryan Russell 2006 Unsafe at any speed? Are you an Internet Explorer user? By that I mean, do you use it for your daily Web browsing? I like Internet Explorer, I think it’s a very capable browser. But, as you are probably aware, there seem to be some safety issues. What do you do when there’s blood on the information superhighway?

Alright, I’ll stop with the car analogies. But I do want to discuss what to do, now that it looks like we’re in for a long road of unpatched IE vulnerabilities. This last week, two unpatched IE vulnerabilities were published. And at least one of them has been proven to be highly exploitable.

Still suffering from drive-by installs

Wait, the “drive-by” term isn’t my fault. That’s what it’s called when a Web site auto-installs software on your computer via a browser vulnerability.

What gets installed on your computer? Spyware, of course. Or, if you prefer specifics, spyware, adware, ransomware, keyloggers, trojans, password stealers, and antispyware. Did I say both spyware and antispyware? Yes, ironically enough, one of the things that is recently being installed in drive-bys are tools that purport to be antispyware apps.

There’s one easy way to tell: after you scan your machine, and the software confirms that you do indeed have spyware, the company offers to sell you its full version, which can remove the offending code. Specific examples have been exposed by the Sunbelt bloggers on Mar. 8 and Mar. 25. I don’t know if these commercial apps even work after you pay. They’re rather low on my list of antispyware apps to evaluate.

The reason for this particular niche of software is, of course, money. That, and the fact that someone intentionally exploiting your browser is probably committing a crime in most of the world. Point is, shady activity (drive-by installs) usually means shady software. I’ve yet to see anyone hand out a free word processor via a browser exploit.

Is IE that much less secure?

Why do these drive-bys seem to happen almost exclusively to Internet Explorer users?

If you listen to someone who’s a big fan of other browsers or platforms (OK, fine, Firefox and Macs), IE and Windows are just so horribly insecure that of course they get exploited all the time. Clearly I cannot argue that IE is free of vulnerabilities. But I’m of the “market share” school of thought on this matter. This says that the software with the biggest market share will receive a disproportionately large amount of malware or published vulnerabilities.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.

Over the Horizon

Internet Explorer has triple security threat

Chris Mosby 2006 Internet Explorer has triple security threat This month has been pretty rough on the people at the Microsoft Security Response Center (MSRC). There’ve been three new vulnerabilities discovered for my favorite insecure browser — Internet Explorer — in just the last two weeks.

Of those three vulnerabilities, one will cause IE to crash at worst. But the others are severe enough to allow infected code to run that could very well take over your computer. Here we go again. The race for a patch begins.

Latest IE flaw already being exploited

Secunia recently discovered a severe vulnerability in IE that can be used to allow a hacker to run infected code on a user’s computer. This hole has been confirmed on a fully patched system with IE 6 SP2 and Windows XP SP2. The flaw has been confirmed in IE 7 Beta 2 (January Edition) as well, according to Secunia’s advisory.

This vulnerability was also reported on public mailing lists, separately from Secunia’s discovery, and now exploit code is widely available.

According to a Websense Security Labs alert, more than 200 unique Web sites have already been found hosting code that exploits this vulnerability. The alert states that the most frequent exploit is to use shell code to execute a Trojan-horse downloader that installs more infected code over HTTP. This other code varies from bots to spyware to back-door programs and further Trojan-downloading programs.

Microsoft is fully aware of this vulnerability and the publicly released exploits and has issued a security advisory about the problem. The company has begun working on a patch to be included in the April security patch cycle, or possibly sooner.

Microsoft also announced that its Anti-Malware Engineering Team has uploaded to the Windows Live Safety Center a set of removal instructions for some known attacks. I recommend going to this Web site if you think you may have been compromised by one of these exploits. Other major antivirus vendors have already produced generic detections for this exploit as well.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.

Patch Watch

Gentlemen, and women too, start your testing

Susan Bradley 2006 Gentlemen, and women too, start your testing Normally before there’s a patch, we don’t get quite the advance notice that we did this time. An Internet Explorer upgrade is coming that can impact your Web-based applications. You need to know now how this may affect you, well before Microsoft releases the patch on Apr. 11.

Why is this patch different? Because it’s not a security patch — it’s a reaction to a patent lawsuit.

(KB 912945)
Your personal patch action plan

I’m going to spend most of this week’s issue on a patch that’s currently way down in the optional patch section of Windows Update.

First, I want you to take one workstation and install this optional patch, KB 912945, and start testing it now. But wait, you may be saying. I was telling you before that you shouldn’t install it, right?

Microsoft has announced in several places that its patent-lawsuit patch will be included in the next cumulative Internet Explorer rollup. That’s expected to be released on Apr. 11 or possibly sooner. The rollup is likely to be rated "critical." Without knowing exactly what’ll be in the security patch, I think it’s safe to say that you’ll probably want to install it quickly to close whatever security hole(s) it fixes. That will install the patent downgrade at the same time.

Here’s the problem. Some applications — in particular, line of business, Web-based applications — will experience problems after IE is updated. In the KB article mentioned above, a few vendors in this situation have already been identified. Siebel, for example, indicates that its product will need an update, which is not available at this time.

It’s critical that you review all Web-based applications you use to see whether KB 912945 will require a fix to be issued by a vendor. For external Web sites, the affected Web designers will provide an update and you won’t need to install anything. (These sites may not work as expected, however, until their updates happen.)

For a look at the interactions you might see on Web sites that haven’t yet been updated, I recommend that you review Sandi Hardimier’s blog site, SpywareSucks. This goes into detail on the issues that might bite you.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.

Woody's Windows

Changing registered owner in Windows and Office

Woody Leonhard 2006 Changing registered owner in Windows and Office Does Office think your name is “Satisfied Dell Customer”? When you install new programs, do they want to send a confirmation e-mail to “OEM User”?

Or — raise your hand if this sounds familiar — when you first installed Windows, did you misspell your own name? Hey, it’s happened to me. More than once. If you’ve ever wanted to turn back the clock and tell Windows or Office that the name or organization permanently emblazoned in your PC’s memory is all wet, this secret’s for you.

A rose by any other name

When you first install Windows, the installer prompts you to type in your name and organization. If you bought your computer with Windows pre-installed, you probably had an opportunity to type your name and organization, too, although the computer manufacturer may have filled it in for you. (Thus, the ubiquitous Satisfied Dell Customer.)

Note that I’m not talking about user names — the names that appear on the Welcome screen, which allow Little Billy to have his own settings that don’t mess up Dad’s and Mom’s and Uncle Fester’s. I’m talking about RegisteredOwner, the name that appears when you click Start, right-click My Computer, and choose Properties. That name pops up in all sorts of weird places.

You might think the name and organization live somewhere deep inside your PC, chiseled in stone on some super-secret security chip. Not so. In fact, they’re both stored in the Windows Registry — and they’re very easy to change, if you know where to look.

Tweaking the Registry safely

Many people believe that demons and monsters lurk inside the Registry; one wrong step, and your system’s toast, never to boot again.

Guess what? They’re right.

If you bang around the Registry like a longhorn in a Lladro shop, you may well succeed in reducing your PC to a lump of quivering dissociated electrons. But if you’re reasonably good at following instructions — say, on a par with the “Apply, lather, rinse, repeat” directions on a shampoo bottle — there’s no reason in the world why you can’t go in and change your registered owner name, and live to tell the tale.

Finding RegisteredOwner in the Registry

To dig into the Registry, you need a program called the Registry Editor. It’s easy to find: click Start, Run, type regedit and press Enter.

On the left side of the Registry Editor window, double-click HKEY_LOCAL_MACHINE, then double-click SOFTWARE, then double-click Microsoft, then double-click Windows NT (yes, it’s Windows NT, even if you’re using Windows XP), then double-click CurrentVersion.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.

YOUR SUBSCRIPTION

The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, the week of Thanksgiving, and the last two weeks of August and December. Windows Secrets is a continuation of four merged publications: Brian's Buzz on Windows and Woody's Windows Watch in 2004, the LangaList in 2006, and the Support Alert Newsletter in 2008.

Publisher: WindowsSecrets.com, 1218 Third Ave., Suite 1515, Seattle, WA 98101 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine).

Editor in chief: Tracey Capen. Senior editors: Fred Langa, Woody Leonhard. Copyeditor: Roberta Scholz. Program director: Tony Johnston. Contributing editors: Yardena Arar, Susan Bradley, Scott Dunn, Michael Lasky, Scott Mace, Ryan Russell, Lincoln Spector, Robert Vamosi, Becky Waring. Product manager: Andy Boyd. Advertising director: Eric Gilley.

Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, Support Alert, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com. All other marks are the trademarks or service marks of their respective owners.

HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page.

WE GUARANTEE YOUR PRIVACY:

1. We will never sell, rent, or give away your address to any outside party, ever.
2. We will never send you any unrequested e-mail, besides newsletter updates.
3. All unsubscribe requests are honored immediately, period. Privacy policy

HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,

Visit our Unsubscribe page.

Table of contents

Top-scoring articles in the past 12 months

Internet Services

Web Development

Digital Marketing

Consumer Tech