3 ms·
This is a global issue. We all experienced friends or people asking for joining them on their social network, or their IM app, which unfortunately you're not on
by kerouanton 10y ago
This is a global issue. We all experienced friends or people asking for joining them on their social network, or their IM app, which unfortunately you're not on. Same for vendors and partners and such that ask you to create accounts on their websites for sometimes just a single event or document to sync. XKCD recently published a fun illustration of it (1810).
On the other hand, most of us want to split between work and friends, between private and public. So we have different accounts for this purpose. I don't use Twitter and Linkedin the same way, and I don't have the same circle of relations connected by those means. So it may be "convenient" to have separate accounts, but at the same time this becomes a burden to maintain and check every of these (not counting data breaches and so).
My current practice is the following :
- an email address for my close friends & family.
- some public accounts for infosec usage (linkedin, twitter...)
- some undisclosed accounts for my professional usage.
- some undisclosed accounts for my private usage (ecommerce etc.)
- all the rest (a vast majority) uses throw-away emails (I own a domain, enabling me to generate unique email addresses per website) and random passwords, so I don't care to monitor them or if they are breached. If I know I won't use the site frequently I don't even remember the password, I just do a "recover password" if I need it in the future.
My rules:
1. never reuse the same email twice for websites. That also helps me monitor breaches and/or spam and/or db resellers.
2. never reuse the same password twice. Obviously.
3. never use 3rd party authent such as "Login with FB, Twitter or Gmail", as it breaches the first rule.
It generates some work to maintain all of this, but I've been doing it since probably over a decade, and it's now an habit I can't quit, considering the benefits.
So, back to the paper, I'd tend not to follow this guideline, even if I'm tempted to do so.
- GrinningFool 10y agoI'm in the process of setting up the same thing for my email. Any interest in sharing what you're using?
- AstroJetson 10y agoI have a godaddy domain with email. I give each company companyname@myfakedomain as the email. They all forward to me at astro@myrealdomain. If/when they aggressively send me aggravating email, I flip it to forward to some big wig at the company and forget about it. Works well and is pretty cheap.
- GrinningFool 10y agoThanks, though I am looking for something that I can manage myself. I won't say without a third party - using a VPS - but I am trying to build it such that I can pick up and move to a different VPS provider without a lot of pain.
- kerouanton 10y agoSure, I had a post about my setup on my blog around 1y ago : éé.net/ak5
- GrinningFool 10y agoExcellent, thank you.