DuckDuckGo Email Protection (aliasing service)

[Sprout3425]

and if not, I will be wrong! Like discussing to you btw

[Encounter5729]

Basically you pay by the potential of you becoming a DDG user which will click on ads. Kinda a modified freemium model.

[Sprout3425]

That is what I was trying to say

[Critical_Crab5543]

According to SimpleLogin, the PGP feature is not useful if you’re using a provider like Proton Mail for your mailbox because “ProtonMail already encrypts all emails with the public PGP key of your ProtonMail account and store your emails with zero-access encryption.”

[whoami5 (whoami)]

@landordragen

created my aliases via Bitwarden. You will need the API authorization item and you are good to go.

Username & Password Generator | Bitwarden Help Center

how did i live without this

[Sprout3425]

Just realised AnonAddy does not allow you to send emails from aliases, but allows you to reply to them using your alias, which does not make much sense to me, yet another way DDG excels. I think DDG is a no-brainer ATM.

[Tech-Trooper]

Could you tell me on which platform DDG is absent except for Linux?
For instance, cryptee only works with pwas?

Edit1: [quote=“Encounter5729, post:46, topic:12386, full:true”]
Basically you pay by the potential of you becoming a DDG user which will click on ads. Kinda a modified freemium model.
[/quote]

Unless ublock does not already block all ads.

Edit 2: What is annoying about DDG email protection is that you have to find your API key using developer tools in your browser.

[Encounter5729]

@Tech-Trooper

Could you tell me on which platform DDG is absent except for Linux?

Duckduckgo browser doesn’t block microsoft trackers. See Update metadata · duckduckgo/iOS@bdef943 · GitHub

[Tech-Trooper]

This is straw man argument.

First of all, we are talking about DDG alias service, whereas this is about DDG’s browser tracking protection.

While it doesn’t seem good to whitelist Microsoft trackers, for instance, vanadium does not block anything by default.

Lastly, they changed this long time ago. Brave was caught in the past for injecting their own referral code et. No project is perfect.

Edit:

You claim that it’s not available at first, then, as an answer you refer to the Microsoft whitelisting.

[Encounter5729]

You said yourself it wasn’t available on Linux

[Tech-Trooper]

This was my question and your answer.

[Encounter5729]

Attack ideas, not people. Not productive.

[Tech-Trooper]

I am not attacking you. I said it’s available on all platforms except Linux.
You quoted me and brought another issue which is old and solved.

[Sprout3425]

@Sprout3425

@Anonymous

If we compare the free tier, it looks similar or better than AnonAddy or SimpleLogin.
I tried it for a month now with no problem.

We definitely need a formal comparison, although it seems to me that the unlimited shared domain aliases is a big win for Duck Duck Go (DDG), whereas the nearest competitor has a mere 10. However, there are many more features to compare between the free versions of DDG and addy.io for example.

Also, the @duck.com domain is totally fun, I have taken the opportunity to get myself some cheeky email address using this domain, because DDG allows you to make one completely custom email address per account (can you see where this is going).

One feature that DDG seems to exclusively provide is email address filtering, however, this seems to be redundant (although maybe DDG could filter things Proton misses) since I believe that Proton Mail (the free version) also does this.

Consequently, the free version of DDG is similar to the paid version of addy.io .

There are no privacy trade offs with using DDG either, because the service is so simple, i.e., not unnecessarily complex, you can reap the benefits of the service by installing their extension once, and then setting DDG up on Bitwarden, before uninstalling their browser extension.

Another feature I forgot to mention is that there is no signup involved, you only need to provide DDG your email address.

With DDG you can not track your aliases, but this is intentional, aliases along with the ‘trackers blocked’ statistic, are shown within banners in the emails themselves, when these aliases receive emails, in your non-alias inbox.

DDG also provides unlimited replies and the ability to send emails from your aliases for free! Tracking these statistics seems to have no purpose, although addy.io provides you with this ability for some reason.

I am currently using addy.io , would everyone agree that the most optimal solution (as a free user) is to use the DDG aliasing service via Bitwarden?

---

Below are definitions of standard versus shared domain name aliases for reference (from addy.io ’s help page):

Standard Aliases - Standard aliases use a domain that is unique only to you, all aliases for your custom domains are classed as standard aliases. Standard aliases can be created automatically when they receive their first email (if catch-all is enabled for the domain). If you signed up with a username of johndoe and gave out the following alias - hello@johndoe.anonaddy.com then this would be a standard alias.

Shared Domain Aliases - A shared domain alias is any alias that has a domain name that is also shared with other users. For example anyone can generate an alias with the @anonaddy.me domain. Aliases with shared domain names must be pre-generated and cannot be created on-the-fly like standard aliases.

After reading this you should be able to see why standard domains are much easier to track across sites (because they are completely unique to you), and why this is a huge benefit that DDG has over addy.io .

If an army of @duck.com domains flood online internet services with the randomised email address (quack!), for example: 4kt6cil9@duck.com, it will be hard to determine you are the same person on one website compared to another, where you and others would have the same domains, but different addresses, across different services. I.e., you would generate another random address for another service and fit amongst other DDG users. To make matters more complicated for adversaries, duck email addresses always have the same number of characters (8) for each randomised alias.

This is a kind of unclear explanation, if someone can explain this in more detail be my guest.

Sorry to be bothersome, but are the PG team going to give this tool a fair look? Because I think most of the potential shortcomings of this tool have been addressed, and I think this tool is very powerful for free users especially.

[Encounter5729]

@Sprout3425

With DDG you can not track your aliases, but this is intentional,

DDG will keep a list of your allias, since you can change the forwarding e-mail. They just will not display it to you. How is that intentional ?

Privacy Guides General Criteria states that :

• Cross-Platform Availability: We typically prefer recommendations to be cross-platform, to avoid vendor lock-in.

DuckDuckGo Browser isn’t available on Linux. DDG Browser isn’t recommended by Privacy Guides. Installing any extension except uBlock Origin isn’t recommended by Privacy Guides.

The only way I see this being reccomendable is with Bitwarden integration, but we would need a pledge by DuckDuckGo that they will not take away that feature. Afterall, this allias is made for Duck users.

[Sprout3425]

@Encounter5729

DDG will keep a list of your allias, since you can change the forwarding e-mail. They just will not display it to you. How is that intentional ?

See my original post, I explained this already:

@Sprout3425

With DDG you can not track your aliases, but this is intentional, aliases along with the ‘trackers blocked’ statistic, are shown within banners in the emails themselves, when these aliases receive emails, in your non-alias inbox.

@Encounter5729

DuckDuckGo Browser isn’t available on Linux. DDG Browser isn’t recommended by Privacy Guides.

This has been entirely addressed. Not sure what you mean, because to my knowledge the extension and aliasing website is available on all browsers. Furthermore, someone suggested that you could create aliases through the DDG app on mobile phones. Essentially, however you create the aliases, they are usable anywhere, and you certainly don’t need their browser to create aliases!

@Encounter5729

Installing any extension except uBlock Origin isn’t recommended by Privacy Guides.

Again, this has been addressed, you only need to install the extension once.

@Encounter5729

The only way I see this being reccomendable is with Bitwarden integration, but we would need a pledge by DuckDuckGo that they will not take away that feature. Afterall, this allias is made for Duck users.

I agree, however, they have indirectly comitted to this because they and other aliasing companies have become official partners with Bitwarden, Bitwarden even quotes their CEOs.

Apologies if I come off as rude @Encounter5729, my intention is not to do so.

Edit:

I have realised that you can create 10 or however many aliases you want (up to infinite aliases), and as someone intelligently suggested, you can then note them down. This would simultaneously refute the need to trust that Bitwarden and DDG will withhold their partnership, the need to use Bitwarden at all and the need to use the extension ever again or at least only a few times!

[Showplace8087]

This is the first I’m hearing of being able to set up random aliases with Bitwarden! I’m having some trouble and was hoping someone could help me out. I have the extension in FF, I’m logged into my DDG email, I go to the “Generate Private Duck Address” page but am lost from there. I tried going to “More tools” - “Web Developer Tools” - “Network” but can’t find the API authorization item. Am I missing it or looking in the wrong place??

Edit, N/m I got it squared away! Thanks again for this info cause I never knew it existed! Here’s a easy to follow guide for anyone in the future that might need help…

How to get unlimited masked emails to keep your inbox secure, private

[Encounter5729]

Is it open-source or audited ?

(Edit: removed mention of app-extension-bitwarden as it is beating a dead horse)

[Tech-Trooper]

One of the interesting thing about DDG aliasing is that duck domain has not been blocked by any website I have used so far, whereas I see some websites that do not accept SimpleLogin. It may change in the future, however.

[Gnarleyeh]

If one is already a Proton unlimited user then, I can’t see how not providing a list ( DDG ) is useful ?
IMHO, Simple Login is superior.
While I am on this topic, why do free services receive any print ? Isn’t that why we are here as Privacy supporters ? Surely the mantra of being the product should carry forward to all app/ services ?
Now, I’ll put on my Ken Dryden mask …