Richard Lack's Blog: Who's got your e-mail address

Have you ever considered how many sites have your e-mail address? About 18 months ago I sat down and performed a few fag-packet calculations and figured that at least 4,500 sites have mine. Don't ask me how I arrived at that figure - but it's the sum total of all the sites, the forums, and the registration pages of all kinds I've ever filled in since 1995. In the last 24 hours alone I've given my e-mail address to no less than 15 sites.

So there I sat - concerned and feeling slightly slutty that so many people have my e-mail address. Perhaps more worryingly - I use the same password for everything I do. The account I use to access any one of seven webmail accounts employs the same [patently obvious] password that I use to access my joint bank account. If somebody wanted to rip me off they'd have a field day. Now I don't consider myself paranoid but If I got drunk at a party and handed out 4,500 copies of my front door key to relative strangers I'd be worried...and embarrassed

Worse still is the fact that once you publish your e-mail address to a web page - maybe just your homepage, perhaps just a post that you made to a thread on the Iraq crisis - it's only a matter of time before the Spam Spiders come and get you. Spiders? Yes. Even novice spam-punks can download free e-mail extractor software that lets them send eager little spiders out to the web which (after a few hours cavorting through HTML files), come back to them with thousands of e-mail addresss garnered from random sites. I've used this software myself and it's alarmingly effective. You can even point it at target victims. After a half hour crash course I managed to rip off the 2,150 e-mail addresses for every member of the law society in the UK. http://www.lawsociety.org.uk/. Child's play! I toyed for a while with the notion of sending them penis enlargement ads, such is my dislike of lawyers.

RULE ONE: NEVER POST YOUR E-MAIL ADDRESS ON THE WEB IF YOU EVER WANT TO SEE THE BOTTOM OF YOUR INBOX AGAIN.

The problem you see is that you never know who you can trust. I just didn't have a clue who was selling my address or leaving the doors to their site wide-open (in violation of their privacy policy). What I did know was that the spam was piling up; some of it shocking, some of it appropriate - I mean how did these guys guess that I'm into transsexual goats?

My solution was thus:
RULE TWO: NEVER GIVE OUT YOUR *REAL* EMAIL ADDRESS.

Buy your own domain. I bought www.richardlack.com. It cost me £10 plus another £20 anually for e-mail forwarding. Now *anything* that's sent to @richardlack.com is forwarded to my broadband e-mail address (which I NEVER give out). Here's how it works. If I want to subscribe to ecademy I give my e-mail address as [email protected]. Likewise if I want to post my opinion on the BBC website I use [email protected]. Simple!

But what's fun is that whenever I get spam I now look at the e-mail address it's been sent to. If I get an offer of censorious concern regarding luscious Latvian lolitas from '[email protected]' which is addressed to [email protected] I'll know that somebody either bought or stole my address from the Beeb. Either way I can go after the bods at broadcasting house and demand damages for breach of privacy.

One final word on the subject.

RULE THREE: If you absolutely MUST post your address on your personal homepage or your corporate website - do what I do: Post your address as a .gif file so it can't be read by spiders: http://www.richardlack.com/contact.htm, or use a prefix that identifies it so you can plug the hole later when it leaks i.e [email protected]

P.S anyone in the market for 2,150 lawyer's e-mail addresses. Never used. One careful owner.