Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to authenticate to THEM for an unlimited number of sites with one email address, but upon registration with a new site, allow you to enter an arbitrary email address specific to that one site in a textbox before it kicks you back to the site you're registering for?

Why: over the years, I've discovered the hard way that there's really only one nearly-foolproof way to avoid spam: I have my mail server configured to allow adhoc aliases, and I use a different email address for every site and sender. Those email addresses are in the form mymailbox-senderspecificalias@mydomain.net.

The advantages are many:

  • If I start getting spammed, I can look at the address, and add a Procmail rule to instantly nuke it thereafter at the mail server.

  • It's the only method that actually works if a site or friend/family member/whomever gets compromised by hackers/malware and the address gets harvested.

At the end of the day, it's a lot easier to tell one person or site, "use mymailbox-senderspecificalias2@mydomain.net from now on" than to keep nuking email address after email address as they succumb to spammers.

It makes a HUGE difference. Today alone, I received approximately 12,380 inbound emails addressed to alleged recipients at my domain... 19 of them were non-spam. I actually had to write a cron job to rotate and delete my Procmail logs, because if I didn't, they'd be several gigabytes within a matter of days.

Here's the problem: most sites I've seen that authenticate through OpenID wrongfully treat the address they receive from OpenID as immutable thereafter. If I'm logging in to some OpenID provider as mymailbox-myopenidprovider@mydomain.net, and ultimately passing that same email address along to every site I use, my whole strategy would quickly fall apart the moment one of those sites starts spamming me or gets harvested by spammers. What I'd like to happen is, after authenticating to the OpenID provider, when it gets to the page where it would normally ask me for permission to share my email address with the other site, I'd like to be presented with a dialog box that will allow me to enter whatever unique email address I want to use for that particular site.

So... are there any?

share|improve this question
    
Sounds like you need to use SpamHaus and require RDNS for the originating IP. Those two alone will cut your spam by at least 80%. –  Ben Jan 20 at 16:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.