6 ms·

Now we know where to try the associated password. Makes me think I need a better strategy on the username side to not leak that info.

by buro9 8y ago

cm2187 8y ago
Also it makes it easy to guess what other alias you would have used for another website. Short randomly generated hex is a much better solution.
- ascar 8y ago
  There is a pretty cool keepass plugin [1] that generates randomly generated readable passwords based on a dictionary with definitions of nouns, verbs and adjectives and multiple patterns to create short sentences. Even if the dictionary and patterns are known by an attacker, this still has very good entropy on ~16 characters long sentences. For usernames you can easily just go down to the minimum (around 6-10). I find this superior to random values in a lot of places as it's easily readable and it's also easily typeable, when copy-paste doesn't work. [1] https://bitbucket.org/ligos/readablepassphrasegenerator/wiki/Home https://bitbucket.org/ligos/readablepassphrasegenerator/wiki...
  - xapata 8y ago
    Also available as a 1Password feature. It's inspired by the XKCD "correct horse battery staple" comic.
  - Evidlo 8y ago
    Self-plug: passhole is a keepass CLI password manager that has this feature built in. http://github.com/evidlo/passhole http://github.com/evidlo/passhole
- stanmancan 8y ago
  If you're using a password manager to randomly generate long, secure passwords, the email address shouldn't matter much. The only potential issue would be social engineering to gain access to the account, but seeing how most people use the same email everywhere, I would think you'd have to a potential target for that to be of concern.
  - cm2187 8y ago
    There are good reasons to provide unique aliases to companies requesting an email: - if they start sending you spam you can severe their capacity to contact you by deleting the alias - if they give your contact to a third party, you know from the alias who leaked your email address - if you see an email on a data breach like this one, you know immediately which website got hacked - it makes it really hard to correlate your identity across two websites
    - FabHK 8y ago
      Agreed. And it's so easy to set up when you have your own domain, I'm somewhat surprised not more people are doing it. Oh well.
      - wingworks 8y ago
        It would be cool if there was something like this built into a password manager
        majikandy 8y ago
        There is, it will save off whichever username you use when you sign up eg facebook@domain.com - works well for me.
    - stanmancan 8y ago
      I don't disagree with providing unique emails to various services, I just don't think that _randomstring_@your-domain.com is better than myspace@your-domain.com than. I actually think it's worse, since it's more difficult to identify when an email is coming from the wrong place. If I get an email to myspace@domain.com and it's not from MySpace, I know right away. That's not as immediately obvious if I get an email to a random string.
      - deleted 8y ago
        [deleted]
- usrusr 8y ago
  But how will I guess my email when I do want to reconnect with my account? I see why obfuscation (well, anything to avoid predictability, up to that random hex) is advisable, but the convenience trade-off is real.
  - cm2187 8y ago
    If you do that out of memory, you are most likely re-using passwords. Re-using passwords with an easily guessable login isn't a good combination.
    - throwanem 8y ago
      > If you do that out of memory, you are most likely re-using passwords. How does that follow? It still adds value to use aliases that identify the site where they're used, because then you don't need to do a hashtable lookup to see where your mail is coming from.
    - usrusr 8y ago
      Re-using passwords with a unique login would indeed be stupid because it would not only be weak against attackers but also have terrible ergonomics: it's usually much easier to regain access after forgetting the password than to regain access after forgetting the login. Source: I often forget both of them. What I and many others do is reuse not a password, but reuse a password formula (in my case with slight but easily memorable variations depending on importance, or if forced by stupid password rules). If you saw a dozen of my email/password combinations in the clear you would be able to reverse engineer the rules and then guess combinations for arbitrary sites almost as good as me. It's a calculated risk, just like trusting a password manager is a calculated risk. Right now I consider password managers the better trade-off, but still only slightly better, by a margin small enough to make it not worthwhile to invest in a habit change. If the "formula" I happen to use was just a little harder to reverse engineer than it sadly is I would consider it strictly safer than password managers.
ljcn 8y ago
If you're using a password manager you could generate a random local-part and store that too.
petercooper 8y ago
I tried it on MySpace and it didn't work. Nor could I figure out what did work or what my account even is/was. I suspect MySpace has removed inactive users, though, possibly due to issues like this.

Now we know where to try the associated password. Makes me think I need a better strategy on the username side to not leak that info.

by buro9 8y ago

Now we know where to try the associated password. Makes me think I need a better strategy on the username side to not leak that info.

cm2187 8y ago

Also it makes it easy to guess what other alias you would have used for another website. Short randomly generated hex is a much better solution.

ascar 8y ago
There is a pretty cool keepass plugin [1] that generates randomly generated readable passwords based on a dictionary with definitions of nouns, verbs and adjectives and multiple patterns to create short sentences. Even if the dictionary and patterns are known by an attacker, this still has very good entropy on ~16 characters long sentences. For usernames you can easily just go down to the minimum (around 6-10). I find this superior to random values in a lot of places as it's easily readable and it's also easily typeable, when copy-paste doesn't work. [1] https://bitbucket.org/ligos/readablepassphrasegenerator/wiki/Home https://bitbucket.org/ligos/readablepassphrasegenerator/wiki...
- xapata 8y ago
  Also available as a 1Password feature. It's inspired by the XKCD "correct horse battery staple" comic.
- Evidlo 8y ago
  Self-plug: passhole is a keepass CLI password manager that has this feature built in. http://github.com/evidlo/passhole http://github.com/evidlo/passhole
stanmancan 8y ago
If you're using a password manager to randomly generate long, secure passwords, the email address shouldn't matter much. The only potential issue would be social engineering to gain access to the account, but seeing how most people use the same email everywhere, I would think you'd have to a potential target for that to be of concern.
- cm2187 8y ago
  There are good reasons to provide unique aliases to companies requesting an email: - if they start sending you spam you can severe their capacity to contact you by deleting the alias - if they give your contact to a third party, you know from the alias who leaked your email address - if you see an email on a data breach like this one, you know immediately which website got hacked - it makes it really hard to correlate your identity across two websites
  - FabHK 8y ago
    Agreed. And it's so easy to set up when you have your own domain, I'm somewhat surprised not more people are doing it. Oh well.
    - wingworks 8y ago
      It would be cool if there was something like this built into a password manager
      - majikandy 8y ago
        There is, it will save off whichever username you use when you sign up eg facebook@domain.com - works well for me.
  - stanmancan 8y ago
    I don't disagree with providing unique emails to various services, I just don't think that _randomstring_@your-domain.com is better than myspace@your-domain.com than. I actually think it's worse, since it's more difficult to identify when an email is coming from the wrong place. If I get an email to myspace@domain.com and it's not from MySpace, I know right away. That's not as immediately obvious if I get an email to a random string.
    - deleted 8y ago
      [deleted]
usrusr 8y ago
But how will I guess my email when I do want to reconnect with my account? I see why obfuscation (well, anything to avoid predictability, up to that random hex) is advisable, but the convenience trade-off is real.
- cm2187 8y ago
  If you do that out of memory, you are most likely re-using passwords. Re-using passwords with an easily guessable login isn't a good combination.
  - throwanem 8y ago
    > If you do that out of memory, you are most likely re-using passwords. How does that follow? It still adds value to use aliases that identify the site where they're used, because then you don't need to do a hashtable lookup to see where your mail is coming from.
  - usrusr 8y ago
    Re-using passwords with a unique login would indeed be stupid because it would not only be weak against attackers but also have terrible ergonomics: it's usually much easier to regain access after forgetting the password than to regain access after forgetting the login. Source: I often forget both of them. What I and many others do is reuse not a password, but reuse a password formula (in my case with slight but easily memorable variations depending on importance, or if forced by stupid password rules). If you saw a dozen of my email/password combinations in the clear you would be able to reverse engineer the rules and then guess combinations for arbitrary sites almost as good as me. It's a calculated risk, just like trusting a password manager is a calculated risk. Right now I consider password managers the better trade-off, but still only slightly better, by a margin small enough to make it not worthwhile to invest in a habit change. If the "formula" I happen to use was just a little harder to reverse engineer than it sadly is I would consider it strictly safer than password managers.

ljcn 8y ago

If you're using a password manager you could generate a random local-part and store that too.

petercooper 8y ago

I tried it on MySpace and it didn't work. Nor could I figure out what did work or what my account even is/was. I suspect MySpace has removed inactive users, though, possibly due to issues like this.