#email alias

Some estimates suggest that up to 70% of all email traffic is spam yet even on a bad day, we don’t see this in our inboxes, or even across both our inbox and our junk folder combined, so what’s going on?  Well the actual mechanisms used by spam filters and such services as gmail, hotmail, yahoo etc. to block spam are closely guarded secrets, to prevent the spammers working out ways around the safeguards, but the basic theory is likely to be the same across them all.

Each email is scored, let’s assume on a scale from 1 to 5, where 5 is the most likely to be spam and 1 is the safest, least likely to be spam.  Spam filters allocate points based on a wide variety of factors but some of the key ones are:

Source - global lists of email sending servers are maintained both good – white lists – and bad – black lists.  Of course, not all servers are listed and there are various lists so you may find a single server is listed by one of the rating organisations as white but not even listed by others.  Servers which are found to be sending out high volumes of spam get blacklisted, so this is where “Report as spam” buttons contribute to that process.  Of course, you can also “mark as safe” particular sources, perhaps when they’ve gone to your junk folder previously but you dug them out and told the system you wanted that email and future emails from that same source.  And spam filters associated with your own email account can also reference your contacts lists to see if you appear to know the sender already.

Attachments – some attachments are more risky to users and therefore more likely to contain spying software for example.  So if an email comes with a zip file or executable program files attached, spam filters will be more wary of it.

Content – finally, the filters will look for keywords that make it more likely that the email is spam.  An obvious term is “Viagra” but they can also look for graphic content with a high proportion of flesh colours for example, to try to stop pornography.

These factors are combined, and rarely will just one black mark alone lead to an email being rated as the highest risk.

Then your own preferences come into effect, as you can often stipulate how careful your spam filter should be.  The tightest settings may only allow emails rated 1 or 2 through, while if you relax them, then you could get 3s or even 4s reaching your inbox.  5s might not even make it to your junk folder as the email service decides they are so clearly spam they should not even make it that far.

But all this means the system is far from foolproof.  You will get spam in your inbox, and you will find important emails in your junk folder, or if you are really unlucky, they won’t even make it that far.  If you are worried about missing important things, you can relax the settings, but you may not like the volume of spam you then find in your inbox.

This is where Me and My ID can help.  By creating a new email address each time you sign-up somewhere, which is forwarded to your main email, you can begin by accepting all emails to that address, and marking any emails sent via Me and My ID as safe in your spam filtering system.  But if one of those addresses does start to get abused, then you simply delete it or block the particular sender who is misusing that address.  That way, you give companies you want to hear from the benefit of the doubt, and see everything they send you, but can always change your mind and cut them off if they abuse the privilege of being able to email you.  The websites you use never know your personal email address, so you are back in control of what makes it to your inbox, including the spam.

Iain Corby

Chief Privacy Officer

Being generous to the original website, it is possible that someone just guessed them.  Computers are programmed to try multiple combinations of popular first and last names, perhaps with a dot between them, maybe run together, or using just the first initial and last name, and send out emails to see what sort of response they get.  In this example, as the inboxes have been unattended, there was no polite reply, polite request to ‘unsubscribe’ or less polite instruction to stop bothering the recipient.  But the email system uses an international standard called SMTP which does give those who guess email addresses for a living, valuable clues about whether they’ve found a real one or not.  When an email is received, the system may send back code 550 – “mailbox unavailable” – which usually tells the hacker they’ve got a miss not a hit.  If they get a 250 reply, then they’ve hit the jackpot.  There are other codes meaning various things, each of which tells the hacker if they are warm or cold in their search for real email addresses. Of course, what really confirms they struck gold is a personal reply from the recipient, so do think twice before you reply to strangers online.

But it is not just guess work that lets others use your email address.  The fact is that IT security is only as good as its weakest link.  In some cases, that could just be an employee with a memory stick whose keen to make a few quid on the side by walking out of the office with 10,000 email addresses in their pocket.  You can hope that the companies you give your address to have systems in place to stop that, and choose who you trust with your address on this basis, but what if they pass on your address to a partner firm, a supplier, a parent or a subsidiary?  Did you read the line in their terms and conditions about their right to use agents to provide the service they offer?  Let’s face it, did you read the terms and conditions at all?

The reality is, you can never be sure your email address is secure.  It’s a bit like a secret – if you tell your best friend, then you’ve told your best friend’s best friend too, and so on.  One way to deal with this is to have a second email address and use that whenever you sign up online – your “spam” account.  You only use your personal address for friends and family and the spam account for everything else.  But the problem then is that you soon start to miss important emails from companies you do want to hear from.  And the junk folder for that account looks like a pornography convention so you’re not likely to want to check it regularly for an important email.

This is where Me and My ID can help.  Simply create a new email address each time you sign-up somewhere, which is forwarded to your main email, and delete it when it is abused.  You can even just block particular senders to each address but still get the emails you want from legitimate sources. So when one company gives away or loses your email address, it’s only the unique address you gave that company, not your personal email.