Hotmail Aliases Exposed By Signature

Everyone knows what dummy accounts are: extra email accounts set up specifically for questionable recipients and sign-up forms. This is an old method for protecting your main email address from spam and other unwanted solicitations. A recent enhancement to Hotmail has been touted as an easy alternative to dummy accounts.

A few weeks ago Microsoft added the alias feature to Hotmail, which allows users to create up to five totally different @hotmail or @live email addresses. These are not new accounts, aliases are still controlled from a user's existing Hotmail account - no new inbox, username, or password to deal with.

To set up an alias address, simply login to Hotmail, click the gear icon next to Inbox, and select Create a Hotmail alias.

The new alias feature in Hotmail is great compared to how Gmail currently handles additional addresses. Gmail users can append a plus sign (+) and other characters to their email address. For example, if your email is johnsmith@gmail.com, you could give out johnsmith+mail@gmail.com instead. However, there are two big problems with the Gmail method:

1. You cannot send from the + addresses, so replying to anything sent to a + address will reveal your real Gmail address.
2. The people you don't want emails from also know about the + feature. Many have bots set up to remove the “+” and everything else before the “@”, obtaining your true Gmail address.

While Gmail's + feature can help sort incoming messages, it's not a good way to hide your real email address.

Hotmail's alias feature does not suffer from either of these problems. Outgoing mail can be sent from Hotmail aliases, including replies to anything sent to an alias. And since the new addresses can be completely different from your primary Hotmail address, no one can extrapolate your true address.

Unfortunately, the new alias feature has an Achilles Heel, which could reveal your real Hotmail address, and potentially much more.

Your signature.

This very popular feature automatically adds a signature to the bottom of all outgoing email. Most people include an end greeting (e.g. Thanks, Sincerely, Cheers, Regards, etc.), name, and email address in their signatures. Some people include even more. Address, phone number, IM user names, website url, social network info, company, and job title are just some of the extra personal info commonly found in auto-signatures.

Herein lies the problem, Hotmail does not have a method for multiple signatures. So anything sent from an alias address will contain the signature you set up for your actual Hotmail account.

The main address for the test Hotmail account is adamoveratest@hotmail.com. The signature for adamoveratest@hotmail.com contains: my name, the test email address, this website url, Twitter name, and YouTube channel. I then created the alias craigslistadam@live.com for use with craigslist. As you can see from the screenshots below, the signature is automatically added to all outgoing emails, including those sent as an alias.

If you already used an alias to sign up for something you probably shouldn't have, tough luck. Your signature may have exposed you, giving away anything in the signature of your main Hotmail account.

Until this issue is resolved use caution with, or just steer clear of, Hotmail aliases. As it's currently implemented, this feature can lull uninformed users into a false sense of anonymity.

It's too bad. If the signature exploit didn't exist, Microsoft would have come up with an elegant solution for masking your main email address. It looks like the trusty old method of forwarding a dummy account to to your main email (and properly setting up the reply-to address) is still the best way to go.

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
•