starred/anonaddy

Fork 0

mirror of https://github.com/anonaddy/anonaddy.git synced 2026-04-25 22:25:55 +03:00

[GH-ISSUE #173] Responding to sent email creates risk of leaking real email address #732

New issue

Closed

opened 2026-03-14 10:23:56 +03:00 by kerem · 9 comments

kerem commented

2026-03-14 10:23:56 +03:00

Owner

Originally created by @xanoni on GitHub (Jul 7, 2021).
Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/173

Happened to me a few times and it's always extremely annoying ...

You get an email on an alias and you respond to that email
You realize that you forgot to mention something, so you follow-up on your (own) sent message
DOXXED! AnonAddy just forwarded your real email address (which is included in your own quoted text from the previous sent email)

Isn't there some technical solution to this? E.g., filtering out everything that looks like the actual email address or other identifying information? Should be a trivial regex, but so much pain saved?

Originally created by @xanoni on GitHub (Jul 7, 2021). Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/173 Happened to me a few times and it's always extremely annoying ... 1. You get an email on an alias and you respond to that email 2. You realize that you forgot to mention something, so you follow-up on your (own) sent message 3. DOXXED! AnonAddy just forwarded your real email address (which is included in your own quoted text from the previous sent email) Isn't there some technical solution to this? E.g., filtering out everything that looks like the actual email address or other identifying information? Should be a trivial regex, but so much pain saved?

kerem closed this issue

2026-03-14 10:24:01 +03:00

kerem commented

2026-03-14 10:24:07 +03:00

Author

Owner

@willbrowningme commented on GitHub (Jul 7, 2021):

I think this depends on the email client you are using, when I do this in Thunderbird it show's as:

On 07/07/2021 10:16, Will wrote:

quoted email...

So it does not expose the real email.

What client / web app are you using for your email?

Yes it should be possible to remove any mention of the real email from the message body.

@willbrowningme commented on GitHub (Jul 7, 2021): I think this depends on the email client you are using, when I do this in Thunderbird it show's as: On 07/07/2021 10:16, Will wrote: > quoted email... So it does not expose the real email. What client / web app are you using for your email? Yes it should be possible to remove any mention of the real email from the message body.

kerem commented

2026-03-14 10:24:12 +03:00

Author

Owner

@xanoni commented on GitHub (Jul 7, 2021):

What client / web app are you using for your email?

I think this is how most popular webmail clients handle it (Gmail, Live.com, Protonmail, etc.) and probably even Thunderbird if you don't specify a name.

@xanoni commented on GitHub (Jul 7, 2021): > What client / web app are you using for your email? I think this is how most popular webmail clients handle it (Gmail, Live.com, Protonmail, etc.) and probably even Thunderbird if you don't specify a name.

kerem commented

2026-03-14 10:24:17 +03:00

Author

Owner

@xanoni commented on GitHub (Jul 13, 2021):

@willbrowningme curious how you think about next steps here ... as far as I know, most webmail providers don't allow users to sanitize the "From" strings... let me know if you figure out how...

Is this something that you're planning to fix in AA directly any time soon, or should I try to find my own solution?

If the latter, then I would likely write a browser extension that strips out pre-defined regex patterns. But it's a hack, so would be better to have AA do it directly.

(This is somewhat time sensitive to me, given that I don't want more "accidents" to happen..... ticking time bomb)

@xanoni commented on GitHub (Jul 13, 2021): @willbrowningme curious how you think about next steps here ... as far as I know, most webmail providers don't allow users to sanitize the "From" strings... let me know if you figure out how... Is this something that you're planning to fix in AA directly any time soon, or should I try to find my own solution? If the latter, then I would likely write a browser extension that strips out pre-defined regex patterns. But it's a hack, so would be better to have AA do it directly. (This is somewhat time sensitive to me, given that I don't want more "accidents" to happen..... ticking time bomb)

kerem commented

2026-03-14 10:24:22 +03:00

Author

Owner

@xanoni commented on GitHub (Jul 16, 2021):

Hi x,

Thank you for contacting us.

Please note that the only way to customize the original text that is shown when replying to a message is to do it manually for the particular message.

Let us know if you have any questions.

Best Regards,
The ProtonMail Team

@xanoni commented on GitHub (Jul 16, 2021): > Hi x, > > Thank you for contacting us. > > Please note that the only way to customize the original text that is shown when replying to a message is to do it manually for the particular message. > > Let us know if you have any questions. > > Best Regards, > The ProtonMail Team

kerem commented

2026-03-14 10:24:28 +03:00

Author

Owner

@willbrowningme commented on GitHub (Jul 16, 2021):

I've just implemented this using a simple str_ireplace() please try it again now by replying to yourself to check.

Notes:

It will only remove the real email address that your are sending the reply/send from and not any of your other real recipient addresses
It is case insensitive
It will remove multiple mentions of the real email address

@willbrowningme commented on GitHub (Jul 16, 2021): I've just implemented this using a simple `str_ireplace()` please try it again now by replying to yourself to check. Notes: - It will only remove the real email address that your are sending the reply/send from and not any of your other real recipient addresses - It is case insensitive - It will remove multiple mentions of the real email address

kerem commented

2026-03-14 10:24:33 +03:00

Author

Owner

@xanoni commented on GitHub (Jul 17, 2021):

THANK YOU! Will test.

EDIT: misread initially so deleted part of my message

In the end state, would it be possible to have a box in the settings where we can define our own patterns? There's other stuff we may want to remove.

@xanoni commented on GitHub (Jul 17, 2021): THANK YOU! Will test. EDIT: misread initially so deleted part of my message In the end state, would it be possible to have a box in the settings where we can define our own patterns? There's other stuff we may want to remove.

kerem commented

2026-03-14 10:24:38 +03:00

Author

Owner

@xanoni commented on GitHub (Jul 17, 2021):

@willbrowningme seems to be working! however, people should note that it only deletes the email address, not the name before the email address .. so that still has to be sanitized manually, if desired

@xanoni commented on GitHub (Jul 17, 2021): @willbrowningme seems to be working! however, people should note that it only deletes the email address, not the name before the email address .. so that still has to be sanitized manually, if desired

kerem commented

2026-03-14 10:24:43 +03:00

Author

Owner

@willbrowningme commented on GitHub (Jul 19, 2021):

Yes potentially an option to remove user set patterns, I'll do some more tests when I get time.

@willbrowningme commented on GitHub (Jul 19, 2021): Yes potentially an option to remove user set patterns, I'll do some more tests when I get time.

kerem commented

2026-03-14 10:24:48 +03:00

Author

Owner

@xanoni commented on GitHub (Jul 19, 2021):

Got it, thank you.

@xanoni commented on GitHub (Jul 19, 2021): Got it, thank you.

kerem referenced this issue

2026-03-14 11:40:52 +03:00

[GH-ISSUE #732] [Feature] Fallback eMail Recipient #1074

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/anonaddy#732

No description provided.

Rows
Columns