22 ms·
Bitwarden: Generate a Username
- mihau 4y agoNice! Having a deeper integration with services like AnonAddy or SimpleLogin would be even better.
- pedro2 4y agoFYI SimpleLogin joined the Proton family
- nannal 4y agoI am unclear of the benefits of doing this as opposed to just using the password generator prompt and using it for a username. Seems fairly pointless as a feature to me. In addition, in the extension I can't use pass-phrase like generated responses for my username but I can for the password?
- growt 4y agoI agree, right now I mostly use <servicename>@<mycatchalldomain>.com as usernames, that way I can directly see when something arrives at <servicename>@ that should not. I don't see the benefit of "randomizing" the <servicename> part.
- vinay_ys 4y agoJust curious, where do you host your catchall email domain?
- qzx_pierri 4y agoNice try
- MonkeyClub 4y agoNot OP, but thought I'd chip in since I do the same since I left Gmail. I just use a random cheap domain, registered through Gandi. This includes a couple of 3 GB mailboxes each with unlimited aliases, which is quite adequate if you don't use your email as a file store (much). I suppose the "right" way would be through something like Fastmail instead, but the simple arrangement above has worked fine thus far.
- pedro2 4y agoI also use Gandi somewhat, but beware Gandi doesn't allow catch-all. It does allow, however, wildcards in aliases, which allow a semi-catchall, since alias have to have a minimum of two characters besides the asterisk.
- neogodless 4y agoIt doesn't seem popular (here at HN, like Fastmail) but the bang for the buck from NameCheap "private email"[0] is pretty solid. I started using them years ago as an alternative to GoDaddy for domain names, and more recently for hosting my email. At little as $1.24/month for a 5GB mailbox with custom domain names / catch-all. They use something called Jellyfish for spam detection and it's been pretty impressive. A few false negatives but overall catches most of it. And you can use their webmail or any IMAP/POP3/SMTP client. [0] https://www.namecheap.com/hosting/email/ https://www.namecheap.com/hosting/email/
- criddell 4y agoHave you moved a largish email archive from Gmail to Namecheap? I see they tell you to do it with your client but that seems like it might be unreliable when you have gigabytes of mail to move.
- neogodless 4y agoI'm moving some email now using Thunderbird. It's slow and I don't have huge amounts (Gmail tells me 1.39GB). I'm sure it's possible but it might take an hour or so. A bit slow but I don't think it's unreliable. If it is, that's scary because how would I know :) Just moved a folder with 1037 emails and it has 1037 on NameCheap now. Seems like it moved them all! (And it didn't take too long. It's moving a bunch of subfolders now.)
- deleted 4y ago[deleted]
- bin_bash 4y agoI do this too but I often have service workers get very confused why their company name is in my email address. In fact I checked into a hotel once and they made me change it since they thought it was a default placeholder address or something. Random addresses are also somewhat problematic too when they ask me to “confirm my email”. But they just think I have a very strange username.
- growt 4y agoYes I had that from time to time, but I just tell the truth and tell them that their email will automatically get sorted in my inbox and that I get everything @domainname. I imagine thats easier than explaining your email is really 7ahe8Rz2@domainname.com
- hawski 4y agoThe usual benefit is that it makes it unguessable. If someone knows your mycatchalldomain he can guess valid e-mail addresses. That way you can be reasonably sure that if someone else is sending e-mails to a specific address the address got leaked.
- growt 4y agoSpammers will guess anyway. And I happily trade the chance that some spammer guesses <servicename>@ for the convenience that I don't have to look up every single (spam-)email that I get. Maybe if a service would do some kind of "translation" I would consider using it (like this apple service or duckduckgo's email).
- bin_bash 4y ago1Password has Fastmail integration that maps the random email back to the service: https://1password.com/fastmail/ https://1password.com/fastmail/ Downside is you have to use 1password AND fastmail obv.
- memco 4y agoI started thinking of usernames as less secure passwords and therefore randomizing them a few years ago but never thought about the possibility of randomizing the email too. Not only does it help on the spam side of receiving mail but it can help on the login security front since knowing your email address no longer eliminates 33-50% of your login details. It sounds like this is a great enhancement in almost all cases: automated email randomization that is service dependent and also username randomization when you have a site with separate username than your email.
- purerandomness 4y ago1) Web site's user names are typically much more restrictive than passwords. 2) You typically want your user name to be recognizable by the community you're registering at.
- neogodless 4y agoHave you done a signup where the email address is used as a username? Or email address is required? The email address username generation is useful for those cases (assuming you use unique email addresses for each signup.)
- crenwick 4y agoFor one, its built right into the UI so you can generate a name and save it in the bitwarden username field in the same motion. Also, the password generator isn't configured to work for the use cases here (adding your email or a catchall, using less characters, no special characters, etc.). That way you can still sign up for accounts that require email verifications.
- gpa 4y agoI'm not a security expert, but possibly being able to change my username in addition to changing my password due to safety concerns gives an extra layer of security.
- neogodless 4y agoThis will save me some typing, as I already do the "catch-all" based emails exactly like this! EDIT: See note below - this is for the Add Login dialog where it detects the domain you're signup for. (My initial tests were in the generic Generator function, which don't have the full functionality.) > Website Name is limited to the Add/Edit screen on browser and desktop as it requires knowledge of the login's URI, in other locations the username generator will default to Random.
- vaylian 4y agoInteresting. Related: Source code for docker container name generation: https://github.com/moby/moby/blob/master/pkg/namesgenerator/names-generator.go https://github.com/moby/moby/blob/master/pkg/namesgenerator/...
- jonaslejon 4y agoThis was quite funny: if name == "boring_wozniak" /* Steve Wozniak is not boring */ { goto begin }
- plaguepilled 4y agoThis is a big step up in usability for me. Big thanks to the Bitwarden team for identifying a problem and coming up with an unintrusive solution.
- AnonHP 4y agoInteresting feature, but it looks like this has some rough edges. I saw this option a little while ago today from the browser extension (latest version of Firefox on Windows) when I created a new item and wanted to generate a password for it (I didn't want to generate the username since it was assigned by the service), but it wasn't possible to select either of the radio buttons to choose between username and password and the regenerate button also didn't seem to work. I didn't have time to dig in further, and so I chose to generate a passphrase and use that.
- lvass 4y ago>Select this type to use your email provider's sub-addressing (aka "plus addressing" or "aliasing") Anyone knows which providers do this? >e.g. alice+gsd4aqqe@bitwarden.com) If this pattern becomes popular enough, it won't take long until services strip out the + part entirely.
- CGamesPlay 4y ago> If this pattern becomes popular enough, it won't take long until services strip out the + part entirely. Why would they do that? Specifically to spam more discreetly? But it's trivial to auto-filter all non-plus addresses to the trash.
- calmoo 4y agoGmail supports it.
- voxic11 4y agogmail has always supported this and its pretty popular already.
- michaelhoffman 4y agoWorse, I have used services where they changed the email validation code years after setting up my account and then I could no longer log in because my email address had a + in it. So I don't do this anymore. Sneakemail, which lets you do it with hyphens, works pretty well, though.
- dgellow 4y agoIt’s already the case on a lot of websites, I had issues using +plus addresses to register accounts since at least a decade.
- Hamcha 4y agoI've been using catch-all addresses for a decade (with Google Apps.. rip) and I doubt that will ever get counter-measured. It's been really nice to catch those few cases where a service clearly sold my email to advertiser.
- wcrossbow 4y agoFastmail can generate random@fastmail.com email addresses that go straight to your mailbox. Really useful for throaway accounts and low value services. It apparently has an integration with 1password but I can't vouch for it as I haven't used it.
- dempedempe 4y agoI think this is useful for any service, not just throwaway accounts or "low value" services. It provides another layer of anonymity, and makes credential stuffing impossible as a hacker would have no idea that two auto-generated emails address belong to the same person. 1password integration is nice, because you don't have to open up Fastmail to generate a new masked email. I just use catch-all with custom domain, though. That way, I'm not tied to a particular provider, and I can make new "masked emails" on the fly however I want (usually, just using the name of the app/website I'm signing up for). The downside is that you loose the previously mentioned anonymity since a hacker could link your various addresses by domain name. But it's still way better than using the same email address everywhere!
- solidr53 4y agoI can recommend a free alternative https://10minutemail.com/ https://10minutemail.com/ It wont forward to your inbox though and is only suited for temporary usage.
- TAKEMYMONEY 4y agoThese domains eventually get "blacklisted" by signup forms if they're popular enough unfortunately
- zitsarethecure 4y agoI keep wanting to switch to bitwarden from keepassxc, I created an account and installed the apps, but I just can't bring myself to actually upload all my passwords to someone else's computer. Am I just too paranoid?
- di4na 4y agoIt is not someone else computer. It is your password encrypted that get uploaded. Your passwords are only decrypted locally. Feel free to check their app for that :)
- wmkn 4y agoUnfortunately because of the way Bitwarden works you should consider your passwords compromised when Bitwarden itself gets hacked - regardless of vault encryption. Especially if you ever used the web login. To access your account you need to type your master password, the same password that is used decrypt your vault. If a competent hacker gains access to the Bitwarden servers they could install a compromised login page that logs master passwords and with that gain access to password vaults. Sounds far-fetched maybe, but your password security depends completely on the ability of Bitwarden to protect their servers. The encryption is just a minor hurdle once the servers are compromised. Note that 2FA doesn’t help since it is not used for vault encryption.
- chrismorgan 4y ago> Feel free to check their app for that First-party end-to-end encryption is broken by design, especially in the presence of auto-updating.
- fybs 4y agoin the source code: var k=r.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED lol. also ;e.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED" (edit) (https://bitwarden.com/framework-17fddc626c2ea4ff0e8c.js https://bitwarden.com/framework-17fddc626c2ea4ff0e8c.js)
- tbassetto 4y agoThat's from React: https://github.com/facebook/react/blob/a724a3b578dce77d427bef313102a4d0e978d9b4/packages/shared/checkPropTypes.js#L77 https://github.com/facebook/react/blob/a724a3b578dce77d427be...
- zeroonetwothree 4y agoThis phrase is common in FB code (its a long-standing joke I think) so makes sense.
- deleted 4y ago[deleted]
- up6w6 4y agoThey said that integration with Firefox Relay and SimpleLogin was also coming [1], which will probably match 1Password's Fastmail integration. [1] https://www.reddit.com/r/Bitwarden/comments/ucd9d2/new_extension_feature/ https://www.reddit.com/r/Bitwarden/comments/ucd9d2/new_exten...
- mcjiggerlog 4y agoSeems pretty limited to be honest - the usernames aren't going to be unique enough for anything where they have to be globally unique. Unless you include numbers on the end that is, but that's just ugly. LastPass's username generator is much better: https://www.lastpass.com/username-generator https://www.lastpass.com/username-generator. With "lowercase" only and "Easy to say" turned on, the suggestions are really good. This is my go-to when I need a username, and that's as a Bitwarden user!
- AdmiralAsshat 4y agoHow useful is this, though, for just a username? I would think the purpose here would be that you would use unique aliases per service to limit your own risk in the event of a site breach. However, the vast majority of websites these days require a username and an email address. In which case, if I've got 50 unique usernames but they're all tied to a single email, how much am I really protecting myself if the email address gets included in the breach?
- bwbuhse 4y agoOne thing I do, which no clue how helpful it really is, is use a custom domain for my emails with support for catch-all addresses. When I sign up for a new site, I typically put my email as something like "<site-name>@<my-domain>.com". If my data were exposed, I guess someone who realized that could try any variation of the site's name to figure out the exact one in my address, but you could always do something more unique than that. Even something like generate a BitWarden password and use it as the user for the domain.
- mcjiggerlog 4y agoI also use random email aliases for my domain. The random username is because I don't want people to be able to search my username for a service and link me to other accounts online.
- amflare 4y agoIt's less a protection schema and more a canary schema. I use plus-addressing for basically every online account that I create that does not need to be professional in nature. The benefit is that if I start receiving emails from Foo.com sent to myemail+bar@example.com, I know that my bar.com account got compromised and I can do something about it to limit my exposure.
- asasidh 4y agoI have been using generate password feature for usernames as well
- calvinmorrison 4y agoFastmail + 1Password have quite a similar feature, the difference being that you can control it all from your normal email address (the feature is built into fastmail, using JMAP, so that 1password basically calls out to FM and implements a few API calls to generate a random secret email.) Very cool, glad to see more people doing so!
- dandare 4y agoBest design of a documentation page I have seen in ages. Large font, clear hierarchy, great use of color and font weight.
- 8organicbits 4y agoThey don't mention it, but there's a privacy benefit to generating usernames. Most users are predictable/lazy and will use the same username on every website. However, tools exist for finding accounts across services that have the same username. Generating a unique username and storing it in your password manager would make it easy to evade these tools. https://github.com/topics/username-search https://github.com/topics/username-search I use different usernames per-site, but I tend to take a couple seconds to think of something (hopefully) clever.
- kurthr 4y agoIt seems like most websites use your email address as the username, which makes this more difficult. You could use + addressing, which makes it unique, but doesn't really make it private... really need hidemyemail or something similar! I do wish this was easy and automated.
- b-ryan 4y agoI have been very happy using fastmail as my email provider and 1password as my password manager. They have an integration which allows you to generate masked emails, which makes what you're describing possible.
- skoskie 4y agoThis. It’s one of those sticky features that keeps me on 1P, but as soon as bitwarden matches it Im out. Looks like we’re getting really close.
- Tagbert 4y agotrue, but most of those sites have a separate field for "display name". No one want's their email address to be tagged on each post. :)
- zeven7 4y agoYou can still often check to see if someone has an account for a service by just .. trying to sign in or retrieve lost password. You often don't need to have the password or access to the email to tell from the response if there's already an account registered for that email address.
- deleted 4y ago[deleted]
- andrewmunsell 4y agoDoes anyone happen to know how pricing works with Bitwarden and a self-hosted Vaultwarden server? Some of the critical features like storing 2fa seeds seem to be locked behind the paywall, but Vaultwarden lists "support" for it and it's unclear whether it's the server software that locks this functionality (and therefore it can be used for free with the Vaultwarden backend) or if it's the client apps.
- lofties 4y agoCan confirm that the self-hosted version does indeed have 2fa seeds behind a paywall -- that being said though, storing both passwords AND your 2fa seeds in the same app feels like a security antipattern.
- andrewmunsell 4y agoI know some people are more sensitive to that, but the annoyance of managing 2fa seeds via some other app (that I have previously had difficulties recovering...) outweighs my actual perceived risk. Thanks for confirming Edit: Based on the other reply to my comment-- are you using the Bitwarden self-hosted solution? I was primarily interested in Vaultwarden, the OSS alternative
- andrewaylett 4y agoStoring my 2FA seeds on Bitwarden (or any other password manager that itself supports 2FA) is still something I have because I need to have a device that's been approved or the security token that 2FA's Bitwarden itself. Whether it's as secure as using a separate TOTP generation app is slightly beside the point, because it's so much more usable. And I don't need to re-bootstrap access to all my accounts when my phone gets run over by a car.
- belthesar 4y agoVaultwarden is a free, OSS implementation of the Bitwarden server, and has no licensing costs. It's API compatible with the official Bitwarden client, which also has no cost. If the client supports the functionality, and server supports the functionality, you're in the clear. Bitwarden's documentation on features and licensing are only applicable to their backend products.
- ghostly_s 4y agoI just wish it would auto-fill my normal email in the username field...
- frou_dh 4y agoHow do you know that a geek has a system where they use a unique variation of their email address for each place they sign up? Answer: Don't worry, they'll tell you about it.
- dspillett 4y agoI'll be that guy: don't knock it, it saves a whole pile of junk mail when companies leak (or sell) your details and you can just turn off that address.
- 1970-01-01 4y agoWhy use Plus Addressed Email? Plus addressed emails allow you to filter your email for all the junk mail you get when signing up for a new service. Signing up for a service with the username alice+rnok6xsh@bitwarden.com will still send emails to alice@bitwarden.com, but you can easily filter emails that include +rnok6xsh to prevent them from clogging up your inbox. In this example, just make rnok6xsh your username and let spam filters do their job. Please stop embedding email addresses in usernames. It rubs GDPR and privacy in a bad way.
- account-5 4y agoI've been doing this for years with Keepass(xc) with the inbuilt password generator. Random alphanumeric username every time. Is this solution better?
- dabber21 4y agoI do that all the time, even with Bitwarden itself, I'm glad I can now generate those emails in Bitwarden