5 ms·

The Case for Unique Email Addresses

28 points by tylerchilds 6y ago

haroldegibbons 6y ago
In theory I agree. In practice I strongly disagree. As soon as I hit more than maybe 3 email addresses it became a burden to maintain and I totally regret it. I could do <servicename>@example.com to make things easier but this is less secure than <random>@example.com
- c22 6y ago
  I find that <servicename> is actually adequate. Your primary adversaries are all automated and the technique is not so widely used to date as to be accounted for by the bots at large. I guess for that extra edge of security you could do it in pig latin.
  - crossroadsguy 6y ago
    Getting the mail isn't the problem. Sometimes I have to reply to those company and especially in a Mail client setup it becomes difficult to reply from <company-name>@mydomain.tld and I often end up replying from <my-first-name>@mydomain.tld and they have my main email as well. Unless of course I setup a "reply-from" for each of these <company-name> emails I used.
    - zeveb 6y ago
      > Sometimes I have to reply to those company and especially in a Mail client setup it becomes difficult to reply from <company-name>@mydomain.tld This was very easy with Unix mail clients twenty years ago — what is wrong with Mail that it doesn't support this functionality?
dfee 6y ago
Tyler, get to the point. I’ve been reading for 5 minutes about Facebook, Tim, and Inflection... and just got to “backstory”. The backstory has a backstory too? Just think about focusing on your primary point.
- jacobobryant 6y ago
  I'm all for concision, particularly in technical writing. But not every article has to be like that. This article feels like a mix between an essay and a public journal entry, and I thoroughly enjoyed reading it.
- Retardo_88 6y ago
  I agree. I gave up halfway through. The author is exceptionally long-winded.
jacobobryant 6y ago
I do this with fastmail. Besides privacy, another benefit is you can set up routing rules. e.g. for subscribing to newsletters, use <whatever>.sub@example.com. Anything that goes to an address that ends in .sub@example.com gets marked as read and is delivered to a folder for newsletters. I do a similar thing when signing up for services. It's kinda like what Gmail does with ML, but you have more control.
- m-p-3 6y ago
  I do this with gmail, when I register an account I'll use firstname.lastname+domain.name@gmail.com. Whoever with more than two brain cells would notice and strip the suffix out, but they usually don't bother with a database leak.
  - jacobobryant 6y ago
    Do you know if they actually don't bother? The article author makes it sound like tracking companies do in fact normalize gmail addresses. I suppose my custom domain addresses wouldn't be too hard to normalize either if you have a way to take a domain and get a probability for how likely it is to be a personal domain. It provides a little extra friction at least, I guess.
hexbinencoded 6y ago
For 12 years, I have had an email setup where all emails for the domain go to one mailbox (postmaster style). Then, I just give each service their own, unique email address without any configuration. Any spam or unusual mail is then easily-identified. Plus, it makes for easier searching, sorting and tagging. A good, secure, backed-up email & webmail setup is necessary to make it work. For anything I don't care about and want better anonymity, I'm fine with using random, public disposable email addresses.
- vinay427 6y ago
  I've started doing this and have ended up depending on my password manager to track which emails I need for logging in to a service, which is a bit of a hassle although I think it's still worth it for the reasons you outlined. For example, did I use [service]@domain.com or [abbreviated-service]@domain.com, or was it [service.com]@domain.com...?
  - sdflhasjd 6y ago
    I also find that some services don't let you use their name in your email address. Samsung is one I remember which wouldn't let me use samsung@domain.com, I managed to get by with smsung@domain.com. Definitely one for the password. Then again, we should be using unique passwords for everything anyway, so a password manage is a must regardless of how you handle emails.
    - throw_away 6y ago
      This also happens to some extent in real life. Often when I say that my email is "your-company-name@my-custom-domain.tld" it's met with a "well, if you're just going to give me a fake address…". At which point I have to explain 1) catch-all email addresses, and 2) yes, you can own your own entire domain name.
  - kalleboo 6y ago
    The only service I have that problem with is Microsoft since it's a merge of like three different accounts (MSN messenger, Skype, and Office365) so I can never remember which is the right one. Otherwise my rule is to use the central part of the domain name (no www or TLD), or it's easy enough to just search my email archive for messages from whatever service.
sdflhasjd 6y ago
The only real reason I use unique email addresses is to handle spam from services I signed up to, and discover data breaches of my own email. 1) Companies that conveniently forget that you opted out of marketing emails every 9 months or so, now I can blacklist them. 2) Twice now has a service had a data breach and I've only found out because I've received spam to the unique email
- throw_away 6y ago
  Also interesting to note which politicians or charitable causes sell your name to which entities.
lmilcin 6y ago
I have own domain and use unique address and password for each service. This lets me know which one leaked it. When Adobe lost both my address and password I tried contacting their support (I was paying customer). The support person repeatedly said they checked and my credentials were safe. This regardless the fact I had proof. Very disappointing. Since then I had couple other situations like that. I guess companies assume users are idiots and use same password everywhere and so they feel safe nobody can prove it is them ho lost it.

28 points by tylerchilds 6y ago

In theory I agree. In practice I strongly disagree. As soon as I hit more than maybe 3 email addresses it became a burden to maintain and I totally regret it. I could do <servicename>@example.com to make things easier but this is less secure than <random>@example.com

c22 6y ago
I find that <servicename> is actually adequate. Your primary adversaries are all automated and the technique is not so widely used to date as to be accounted for by the bots at large. I guess for that extra edge of security you could do it in pig latin.
- crossroadsguy 6y ago
  Getting the mail isn't the problem. Sometimes I have to reply to those company and especially in a Mail client setup it becomes difficult to reply from <company-name>@mydomain.tld and I often end up replying from <my-first-name>@mydomain.tld and they have my main email as well. Unless of course I setup a "reply-from" for each of these <company-name> emails I used.
  - zeveb 6y ago
    > Sometimes I have to reply to those company and especially in a Mail client setup it becomes difficult to reply from <company-name>@mydomain.tld This was very easy with Unix mail clients twenty years ago — what is wrong with Mail that it doesn't support this functionality?

dfee 6y ago

Tyler, get to the point. I’ve been reading for 5 minutes about Facebook, Tim, and Inflection... and just got to “backstory”. The backstory has a backstory too? Just think about focusing on your primary point.

jacobobryant 6y ago
I'm all for concision, particularly in technical writing. But not every article has to be like that. This article feels like a mix between an essay and a public journal entry, and I thoroughly enjoyed reading it.
Retardo_88 6y ago
I agree. I gave up halfway through. The author is exceptionally long-winded.

jacobobryant 6y ago

I do this with fastmail. Besides privacy, another benefit is you can set up routing rules. e.g. for subscribing to newsletters, use <whatever>.sub@example.com. Anything that goes to an address that ends in .sub@example.com gets marked as read and is delivered to a folder for newsletters. I do a similar thing when signing up for services. It's kinda like what Gmail does with ML, but you have more control.

m-p-3 6y ago
I do this with gmail, when I register an account I'll use firstname.lastname+domain.name@gmail.com. Whoever with more than two brain cells would notice and strip the suffix out, but they usually don't bother with a database leak.
- jacobobryant 6y ago
  Do you know if they actually don't bother? The article author makes it sound like tracking companies do in fact normalize gmail addresses. I suppose my custom domain addresses wouldn't be too hard to normalize either if you have a way to take a domain and get a probability for how likely it is to be a personal domain. It provides a little extra friction at least, I guess.

hexbinencoded 6y ago

For 12 years, I have had an email setup where all emails for the domain go to one mailbox (postmaster style). Then, I just give each service their own, unique email address without any configuration. Any spam or unusual mail is then easily-identified. Plus, it makes for easier searching, sorting and tagging. A good, secure, backed-up email & webmail setup is necessary to make it work. For anything I don't care about and want better anonymity, I'm fine with using random, public disposable email addresses.

vinay427 6y ago
I've started doing this and have ended up depending on my password manager to track which emails I need for logging in to a service, which is a bit of a hassle although I think it's still worth it for the reasons you outlined. For example, did I use [service]@domain.com or [abbreviated-service]@domain.com, or was it [service.com]@domain.com...?
- sdflhasjd 6y ago
  I also find that some services don't let you use their name in your email address. Samsung is one I remember which wouldn't let me use samsung@domain.com, I managed to get by with smsung@domain.com. Definitely one for the password. Then again, we should be using unique passwords for everything anyway, so a password manage is a must regardless of how you handle emails.
  - throw_away 6y ago
    This also happens to some extent in real life. Often when I say that my email is "your-company-name@my-custom-domain.tld" it's met with a "well, if you're just going to give me a fake address…". At which point I have to explain 1) catch-all email addresses, and 2) yes, you can own your own entire domain name.
- kalleboo 6y ago
  The only service I have that problem with is Microsoft since it's a merge of like three different accounts (MSN messenger, Skype, and Office365) so I can never remember which is the right one. Otherwise my rule is to use the central part of the domain name (no www or TLD), or it's easy enough to just search my email archive for messages from whatever service.

sdflhasjd 6y ago

The only real reason I use unique email addresses is to handle spam from services I signed up to, and discover data breaches of my own email. 1) Companies that conveniently forget that you opted out of marketing emails every 9 months or so, now I can blacklist them. 2) Twice now has a service had a data breach and I've only found out because I've received spam to the unique email

throw_away 6y ago
Also interesting to note which politicians or charitable causes sell your name to which entities.

lmilcin 6y ago

I have own domain and use unique address and password for each service. This lets me know which one leaked it. When Adobe lost both my address and password I tried contacting their support (I was paying customer). The support person repeatedly said they checked and my credentials were safe. This regardless the fact I had proof. Very disappointing. Since then I had couple other situations like that. I guess companies assume users are idiots and use same password everywhere and so they feel safe nobody can prove it is them ho lost it.