(M. Sandeen for VOA/Techtonics)
Spammers around the world send out millions of emails every day, in some cases laced with malware or ransomware. To escape the inbox clutter, some users are resorting to disposable email addresses. That might curb spam, some security experts say, but it won’t stop targeted attacks.
There is a range of free services that offer disposable or temporary email addresses, useful when users want to sign up for special offers without divulging their real email address.
The homepage of 10 inute Mail, where users can auto-generate addresses and receive messages for a limited time. (10 Minute Mail)
Some, like Spamex, require an account. Others, like 10 Minute Mail and Guerilla Mail, auto-generate a disposable email address without requiring you to sign up. Emails sent through the temporary address show up automatically on the service’s website, where users can read them and reply to them. The address and related emails expire shortly thereafter, within minutes, hours, or days.
“Each service offers a user a great number of temporary email addresses,” said Josiah Hamilton, an attorney and a developer with Spamgourmet, a temporary email service.
Created and run by volunteers, Spamgourmet requires users to sign up and confirm an email address that they want to protect. After that, they can create a temporary address or auto-generate self-destructing addresses to forward email to their protected mailbox. They can specify which messages should get through and filter out undesirable senders.
A screenshot from the homepage of Spamgourmet.org website explains how the service works. (Spamgourmet)
Disposable email management
Keeping track of many temporary and self-destructing accounts can get complicated in the long-term. But Hamilton, a heavy user of temporary email for the past 17 years, said the approach gives users direct control and prevents their real email from falling into the hands of spammers and cybercriminals.
He acknowledged, however, that giving an online service a personal email address “increases [by one] the number of systems and organizations with access to the user’s email messages.” That, in turn, “marginally” increases the likelihood that “one such system is compromised at some point,” he said.
Privacy and security
It is also unclear how much personal information temporary email services save, so it’s always good to read the privacy policy before signing up for anything. Services that don’t require accounts don’t need to collect any information, said Hamilton, but that’s not always the case.
“The addresses themselves expire individually,” he said, “but the user’s ‘account,’ so to speak, stays active indefinitely, as with most internet services.”
And if the service requires far more personal information than is necessary to operate, “that could be a red flag,” he cautioned.
(M. Sandeen for VOA/Techtonics)
Eldon Sprickerhoff, founder and chief security strategist at eSentire, a cybersecurity firm, said he worries about “watering hole” situations, where malicious spammers mark specific employees or developers who frequent legitimate websites. They then target them with infected links and downloads that, once clicked, redirect them to infected sites or set in motion a process to extract information.
“Disposable email addresses won’t help there,” said Limor Kassem, global executive security advisor at IBM Security.
She is also the co-author of a recent study that found that spammers work regular business hours around the world to match their victims’ schedules. India, South America, and China, respectively, are home to the world’s most prolific spammers, according to the research.
Temporary email might help limit spam, said Kassem, but it doesn’t apply to every case or protect users from spam altogether. The most impactful attacks, she noted, look legitimate, seemingly coming from known contacts.
Disposable email can be helpful. But “user awareness, education, and training are much more effective tools,” she said.
