5 ms·

In case anyone needs something similar today: Outlook already allows you to create ephemeral top-level aliases, i.e. XXXX@outlook.com. You can use this to sign

In case anyone needs something similar today: Outlook already allows you to create ephemeral top-level aliases, i.e. XXXX@outlook.com. You can use this to sign up, then delete the alias. It can't be traced back to your account and nobody blocks @outlook.com. https://account.live.com/names/Manage https://account.live.com/names/Manage (not to take away from this announcement at all; just to provide some context. it's an often overlooked feature which people here might appreciate.)

throaway5533 7y ago
I switched to Outlook because of this. I also like how you can set it so only a specific email can login. That way if your alias is compromised, your account won’t be.
ocdtrekkie 7y ago
Microsoft's email management has some neat perks here: You can change which one's the primary as well. It's entirely possible for you to change the email address of your Microsoft account, by adding an alias, making it primary, and then deleting the original. In fairness, there are some quirks with this, my old email address would still get sent some receipts or some newsletters because the configuration for service A, B, or C was buried somewhere else in the account. But generally speaking, it works pretty well. As someone who changed their name but had to keep their Google account with the old one because of how much Google account data/purchases can't be moved to a new account, this felt positively revolutionary. Google accounts can only have one Gmail address for their entire lifetime.
iwasakabukiman 7y ago
Apple also lets you do this with your Me/iCloud address as well.
basch 7y ago
I dont think thats quite the same thing as an Identity Service, its just a component. In Microsoft's world im either using my Microsoft Account to sign in OR using throwaway email addresses, not both. . Apple can get way ahead of the competition by combining about 3 things. 1) Ephemeral email addresses 2) OAuth or apples equivalent tokens 3) Keychain autogenerate and auto-populate If all those products are integrated correctly, this becomes the SINGLE sign on of single sign ons. If a service supports Apple OAuth, your name is hidden, and you only have one Apple password to remember. If the service doesnt support Apple Tokens, then apple fills in a private email address and a random password, and abstracts away the fact that the service doesnt support Apple Tokens. The user experience is nearly the same regardless. Tokens and randomly generated passwords should be managed from the same interface, allowing you to either revoke access (token) or cycle the key (both.) I've felt it for a while, but the banking industry needs to arrive at something similar. Chase, BoA, WF, and Citi should turn Zelle into a banking OAuth Identity Service.
- illvm 7y ago
  Why do users need to have a 3rd party managing their identity? It seems like it would be _safer_ if users could setup their own OAuth infra which would then be certified for use with other systems. For people who lack the expertise or will to roll their own infra then they can use something like Apple ID.
  - basch 7y ago
    How many people do you know running Mastodon nodes instead of using twitter or facebook? >For people who lack the expertise or will to roll their own infra then they can use something like Apple ID. SO 99.9% of the population. It's a nice sentiment, but for what apple is doing to work (random username generation, and identity obfuscation) the only way for it to work is strength in numbers, that the Apple userbase of people who will only use frictionless sign in, becomes too big to ignore, and to tempting too left uncourted. >It seems like it would be _safer_ Im not sure I would say safer. Depending on millions of people to keep their software up to date hasnt historically worked super well for Windows and Wordpress. One central authority patching all its services and 24/7 devops sounds a lot safer than trusting millions of self hosted OAuth servers to be up to date and not compromised. What percent of people who have non-self-updating home routers, do you think go in regularly and press the update firmware button?
maxheadroom 7y ago
>It can't be traced back to your account... I'm sure there's logging or other AD property (think something like sidHistory[0]) to keep track of this. Companies don't like being liable for not being able to provide data under order[s]. [0] - https://docs.microsoft.com/en-us/windows/desktop/ADSchema/a-sidhistory https://docs.microsoft.com/en-us/windows/desktop/ADSchema/a-...
- criddell 7y ago
  What liability is there for not providing data you don't have?
  - maxheadroom 7y ago
    In some countries, it's fiscal liability - such as paying hefty fines. In others, that are not so friendly, the HR representative who receives/processes the legal request and/or whomever the country wishes to charge could very well land in jail[0]. In a choice between strictly maintaining your privacy and fines/jail time, most - if not all - companies will sell you down the river (if given a feasible chance that it doesn't entirely ruin them, say for example, if they weren't purely in the privacy trade) to save their own hide[s] (e.g.: see the whole PRISM scandal and its fall-out). [0] - https://www.reuters.com/article/us-facebook-brazil-idUSKCN0W34WF https://www.reuters.com/article/us-facebook-brazil-idUSKCN0W...
- nothrabannosir 7y ago
  Sorry I meant by the service you're signing into, any of their 3rd party trackers, or in case of a data breach. This sets it apart from e.g. gmail's username+servicename@gmail.com, or a wildcard on a private domainname which only you ever use.
vilhelmen 7y ago
I'm so mad I missed the window where you were supposedly able to merge email accounts. If I want to merge existing separate accounts now I have to terminate the old account, wait like a 9 months/a year(??) for it to expire and be purged, and then add it as an alias, assuming MS doesn't hold the expired account name >:C

throaway5533 7y ago

I switched to Outlook because of this. I also like how you can set it so only a specific email can login. That way if your alias is compromised, your account won’t be.

ocdtrekkie 7y ago

Microsoft's email management has some neat perks here: You can change which one's the primary as well. It's entirely possible for you to change the email address of your Microsoft account, by adding an alias, making it primary, and then deleting the original. In fairness, there are some quirks with this, my old email address would still get sent some receipts or some newsletters because the configuration for service A, B, or C was buried somewhere else in the account. But generally speaking, it works pretty well. As someone who changed their name but had to keep their Google account with the old one because of how much Google account data/purchases can't be moved to a new account, this felt positively revolutionary. Google accounts can only have one Gmail address for their entire lifetime.

iwasakabukiman 7y ago

Apple also lets you do this with your Me/iCloud address as well.

basch 7y ago

I dont think thats quite the same thing as an Identity Service, its just a component. In Microsoft's world im either using my Microsoft Account to sign in OR using throwaway email addresses, not both. . Apple can get way ahead of the competition by combining about 3 things. 1) Ephemeral email addresses 2) OAuth or apples equivalent tokens 3) Keychain autogenerate and auto-populate If all those products are integrated correctly, this becomes the SINGLE sign on of single sign ons. If a service supports Apple OAuth, your name is hidden, and you only have one Apple password to remember. If the service doesnt support Apple Tokens, then apple fills in a private email address and a random password, and abstracts away the fact that the service doesnt support Apple Tokens. The user experience is nearly the same regardless. Tokens and randomly generated passwords should be managed from the same interface, allowing you to either revoke access (token) or cycle the key (both.) I've felt it for a while, but the banking industry needs to arrive at something similar. Chase, BoA, WF, and Citi should turn Zelle into a banking OAuth Identity Service.

illvm 7y ago
Why do users need to have a 3rd party managing their identity? It seems like it would be _safer_ if users could setup their own OAuth infra which would then be certified for use with other systems. For people who lack the expertise or will to roll their own infra then they can use something like Apple ID.
- basch 7y ago
  How many people do you know running Mastodon nodes instead of using twitter or facebook? >For people who lack the expertise or will to roll their own infra then they can use something like Apple ID. SO 99.9% of the population. It's a nice sentiment, but for what apple is doing to work (random username generation, and identity obfuscation) the only way for it to work is strength in numbers, that the Apple userbase of people who will only use frictionless sign in, becomes too big to ignore, and to tempting too left uncourted. >It seems like it would be _safer_ Im not sure I would say safer. Depending on millions of people to keep their software up to date hasnt historically worked super well for Windows and Wordpress. One central authority patching all its services and 24/7 devops sounds a lot safer than trusting millions of self hosted OAuth servers to be up to date and not compromised. What percent of people who have non-self-updating home routers, do you think go in regularly and press the update firmware button?

maxheadroom 7y ago

>It can't be traced back to your account... I'm sure there's logging or other AD property (think something like sidHistory[0]) to keep track of this. Companies don't like being liable for not being able to provide data under order[s]. [0] - https://docs.microsoft.com/en-us/windows/desktop/ADSchema/a-sidhistory https://docs.microsoft.com/en-us/windows/desktop/ADSchema/a-...

criddell 7y ago
What liability is there for not providing data you don't have?
- maxheadroom 7y ago
  In some countries, it's fiscal liability - such as paying hefty fines. In others, that are not so friendly, the HR representative who receives/processes the legal request and/or whomever the country wishes to charge could very well land in jail[0]. In a choice between strictly maintaining your privacy and fines/jail time, most - if not all - companies will sell you down the river (if given a feasible chance that it doesn't entirely ruin them, say for example, if they weren't purely in the privacy trade) to save their own hide[s] (e.g.: see the whole PRISM scandal and its fall-out). [0] - https://www.reuters.com/article/us-facebook-brazil-idUSKCN0W34WF https://www.reuters.com/article/us-facebook-brazil-idUSKCN0W...
nothrabannosir 7y ago
Sorry I meant by the service you're signing into, any of their 3rd party trackers, or in case of a data breach. This sets it apart from e.g. gmail's username+servicename@gmail.com, or a wildcard on a private domainname which only you ever use.

vilhelmen 7y ago

I'm so mad I missed the window where you were supposedly able to merge email accounts. If I want to merge existing separate accounts now I have to terminate the old account, wait like a 9 months/a year(??) for it to expire and be purged, and then add it as an alias, assuming MS doesn't hold the expired account name >:C