Original Author: Scott Barlow - Posted April 17th 2014
Reflexion Total Control includes a unique feature called Address-on-the-Fly, or AOTF for short. The name is very descriptive – this capability enables users to employ an unlimited number of variants of their primary email address, in a specified format, simply by declaring the address “on the fly” when registering on a web site, signing up for a newsletter, giving an address to a new friend, or for any other purpose that requires disclosing an email address. It’s that easy.
AOTF’s are formed by adding a suffix to the left hand side of the root of your standard email address. For example, for the email addressjanedoe@reflexion.net, an AOTF would take the format of janedoe.something@reflexion.net. Any suffix will work, including one with special characters. A common approach is to select a suffix that relates to the context of the disclosure. For example, if Jane is registering on Amazon.com, she might disclose the address janedoe.amazon@reflexion.net, or if she is buying concert tickets at Ticketmaster.com, she might use the address janedoe.ticketmaster@reflexion.net. She could also use any other suffix that she wished. (NOTE: if the format of the email address is jane.doe@reflexion.net, the user would simply add another period to the email, for instance, jane.doe.amazon@reflexion.net.
The new address needn’t be formally created in Reflexion Total Control, as the system automatically recognizes an incoming email with the recipient’s primary address in AOTF format, and hence knows the inbox to which it should be delivered. The first time the system sees a new AOTF, it automatically captures that address (which is a new “To address”), as well as the address of the sender (the “From Address”), and adds that To-From address pair to a special allow list, sometimes called a white list. Because the AOTF is initially known only to the party to whom the user disclosed it, the operating presumption is that an email sent to an AOTF is legitimate and should only be scanned for viruses, and not for spam. Whitelisting the address pair assures that further communication using that address pair will arrive in the recipient’s inbox, and not wind up in a quarantine folder or be blocked as spam.
Because the system records each To-From address pair, it can easily recognize when an address disclosed to one party, for example to Ticketmaster in our prior example, is then used by another party, say XYZTicket. There are only three ways that this can happen: first, Jane Doe may have disclosed the Ticketmaster address to XYZTicket (although it depending upon her standard practice, this may be unlikely); second, Ticketmaster may have shared the address with XYZTicket; or third, Ticketmaster’s address book may have been hacked and the addresses provided to XYZTicket. When the system detects a case in which an AOTF is used by a third party, it brings this to the user’s attention by including a message in the control panel, stating that “The address initially disclosed to Ticketmaster is now in use by another party and may have been compromised.”
If an address has been “shared” with a third party, and the user no longer wishes to communicate with that party, he or she has several options. First, the user may add the new sender to the Block List. Second, the user can limit the use of the address solely to senders at the domain to which it was originally disclosed, in this case – only to users at the Ticketmaster domain. Third, the user can disable the address altogether, in which case all subsequent email sent to the address will only be counted, and then vaporized.
While AOTF provides some neat capabilities, it also has very powerful advantages for email users.
- First, AOTF guarantees that email from desired senders will arrive in your inbox and not get caught in a spam filter or quarantine folder, thereby eliminating annoying false positives, which is a very common problem for certain kinds of mail.
- Second, AOTFs provide an insulating layer of protection for your primary address. You no longer need to be fearful of giving out your primary address, with the risk that one ill-advised disclosure will overwhelm your inbox with spam. If an AOTF starts to attract spam, you can as a last resort disable the address and eliminate all of that spam, without any impact whatsoever on your primary address.
- Third, the combination of our AOTF and control panel features makes it much easier to detect phishing attacks. For example, if you’ve disclosed an AOTF to your bank, and then receive an email on that address that uses your bank’s display address, but the control panel reveals that it is from some other party, you can be assured that the email is a fraud. This is extremely helpful in discerning ever more tailored and deceptive phishing attacks.
- Fourth, AOTFs enable you to identify parties that may be sharing or selling your email address, or whose address book may have been compromised. When all email arrives on a single address, the user really can’t discern the source of the spam that they receive; with AOTFs, they can.
- Fifth, disabling an AOTF provides a very safe and convenient way of “unsubscribing” from a sender’s future communications. Some users are reluctant to use formal “unsubscribe” links, for fear that they may contain a payload or confirm their existence. While AOTF is not a true unsubscribe, it safely accomplishes the purpose from the user’s point of view.
- Finally, AOTF’s enable you to personalize your communications with another party, for example, by adding a client’s name as the suffix, or by adding an amusing tag line to the address that you disclose to a new friend.
If you have questions, please submit a ticket at tickets.reflexion.net, or contact us at support.aotf@reflexion.net.