5 ms·

I am unclear of the benefits of doing this as opposed to just using the password generator prompt and using it for a username. Seems fairly pointless as a featu

by nannal 4y ago

I am unclear of the benefits of doing this as opposed to just using the password generator prompt and using it for a username. Seems fairly pointless as a feature to me. In addition, in the extension I can't use pass-phrase like generated responses for my username but I can for the password?

growt 4y ago
I agree, right now I mostly use <servicename>@<mycatchalldomain>.com as usernames, that way I can directly see when something arrives at <servicename>@ that should not. I don't see the benefit of "randomizing" the <servicename> part.
- vinay_ys 4y ago
  Just curious, where do you host your catchall email domain?
  - qzx_pierri 4y ago
    Nice try
  - MonkeyClub 4y ago
    Not OP, but thought I'd chip in since I do the same since I left Gmail. I just use a random cheap domain, registered through Gandi. This includes a couple of 3 GB mailboxes each with unlimited aliases, which is quite adequate if you don't use your email as a file store (much). I suppose the "right" way would be through something like Fastmail instead, but the simple arrangement above has worked fine thus far.
    - pedro2 4y ago
      I also use Gandi somewhat, but beware Gandi doesn't allow catch-all. It does allow, however, wildcards in aliases, which allow a semi-catchall, since alias have to have a minimum of two characters besides the asterisk.
  - neogodless 4y ago
    It doesn't seem popular (here at HN, like Fastmail) but the bang for the buck from NameCheap "private email"[0] is pretty solid. I started using them years ago as an alternative to GoDaddy for domain names, and more recently for hosting my email. At little as $1.24/month for a 5GB mailbox with custom domain names / catch-all. They use something called Jellyfish for spam detection and it's been pretty impressive. A few false negatives but overall catches most of it. And you can use their webmail or any IMAP/POP3/SMTP client. [0] https://www.namecheap.com/hosting/email/ https://www.namecheap.com/hosting/email/
    - criddell 4y ago
      Have you moved a largish email archive from Gmail to Namecheap? I see they tell you to do it with your client but that seems like it might be unreliable when you have gigabytes of mail to move.
      - neogodless 4y ago
        I'm moving some email now using Thunderbird. It's slow and I don't have huge amounts (Gmail tells me 1.39GB). I'm sure it's possible but it might take an hour or so. A bit slow but I don't think it's unreliable. If it is, that's scary because how would I know :) Just moved a folder with 1037 emails and it has 1037 on NameCheap now. Seems like it moved them all! (And it didn't take too long. It's moving a bunch of subfolders now.)
    - deleted 4y ago
      [deleted]
- bin_bash 4y ago
  I do this too but I often have service workers get very confused why their company name is in my email address. In fact I checked into a hotel once and they made me change it since they thought it was a default placeholder address or something. Random addresses are also somewhat problematic too when they ask me to “confirm my email”. But they just think I have a very strange username.
  - growt 4y ago
    Yes I had that from time to time, but I just tell the truth and tell them that their email will automatically get sorted in my inbox and that I get everything @domainname. I imagine thats easier than explaining your email is really 7ahe8Rz2@domainname.com
- hawski 4y ago
  The usual benefit is that it makes it unguessable. If someone knows your mycatchalldomain he can guess valid e-mail addresses. That way you can be reasonably sure that if someone else is sending e-mails to a specific address the address got leaked.
  - growt 4y ago
    Spammers will guess anyway. And I happily trade the chance that some spammer guesses <servicename>@ for the convenience that I don't have to look up every single (spam-)email that I get. Maybe if a service would do some kind of "translation" I would consider using it (like this apple service or duckduckgo's email).
    - bin_bash 4y ago
      1Password has Fastmail integration that maps the random email back to the service: https://1password.com/fastmail/ https://1password.com/fastmail/ Downside is you have to use 1password AND fastmail obv.
  - memco 4y ago
    I started thinking of usernames as less secure passwords and therefore randomizing them a few years ago but never thought about the possibility of randomizing the email too. Not only does it help on the spam side of receiving mail but it can help on the login security front since knowing your email address no longer eliminates 33-50% of your login details. It sounds like this is a great enhancement in almost all cases: automated email randomization that is service dependent and also username randomization when you have a site with separate username than your email.
purerandomness 4y ago
1) Web site's user names are typically much more restrictive than passwords. 2) You typically want your user name to be recognizable by the community you're registering at.
neogodless 4y ago
Have you done a signup where the email address is used as a username? Or email address is required? The email address username generation is useful for those cases (assuming you use unique email addresses for each signup.)
crenwick 4y ago
For one, its built right into the UI so you can generate a name and save it in the bitwarden username field in the same motion. Also, the password generator isn't configured to work for the use cases here (adding your email or a catchall, using less characters, no special characters, etc.). That way you can still sign up for accounts that require email verifications.
gpa 4y ago
I'm not a security expert, but possibly being able to change my username in addition to changing my password due to safety concerns gives an extra layer of security.

by nannal 4y ago

growt 4y ago

I agree, right now I mostly use <servicename>@<mycatchalldomain>.com as usernames, that way I can directly see when something arrives at <servicename>@ that should not. I don't see the benefit of "randomizing" the <servicename> part.

vinay_ys 4y ago
Just curious, where do you host your catchall email domain?
- qzx_pierri 4y ago
  Nice try
- MonkeyClub 4y ago
  Not OP, but thought I'd chip in since I do the same since I left Gmail. I just use a random cheap domain, registered through Gandi. This includes a couple of 3 GB mailboxes each with unlimited aliases, which is quite adequate if you don't use your email as a file store (much). I suppose the "right" way would be through something like Fastmail instead, but the simple arrangement above has worked fine thus far.
  - pedro2 4y ago
    I also use Gandi somewhat, but beware Gandi doesn't allow catch-all. It does allow, however, wildcards in aliases, which allow a semi-catchall, since alias have to have a minimum of two characters besides the asterisk.
- neogodless 4y ago
  It doesn't seem popular (here at HN, like Fastmail) but the bang for the buck from NameCheap "private email"[0] is pretty solid. I started using them years ago as an alternative to GoDaddy for domain names, and more recently for hosting my email. At little as $1.24/month for a 5GB mailbox with custom domain names / catch-all. They use something called Jellyfish for spam detection and it's been pretty impressive. A few false negatives but overall catches most of it. And you can use their webmail or any IMAP/POP3/SMTP client. [0] https://www.namecheap.com/hosting/email/ https://www.namecheap.com/hosting/email/
  - criddell 4y ago
    Have you moved a largish email archive from Gmail to Namecheap? I see they tell you to do it with your client but that seems like it might be unreliable when you have gigabytes of mail to move.
    - neogodless 4y ago
      I'm moving some email now using Thunderbird. It's slow and I don't have huge amounts (Gmail tells me 1.39GB). I'm sure it's possible but it might take an hour or so. A bit slow but I don't think it's unreliable. If it is, that's scary because how would I know :) Just moved a folder with 1037 emails and it has 1037 on NameCheap now. Seems like it moved them all! (And it didn't take too long. It's moving a bunch of subfolders now.)
  - deleted 4y ago
    [deleted]
bin_bash 4y ago
I do this too but I often have service workers get very confused why their company name is in my email address. In fact I checked into a hotel once and they made me change it since they thought it was a default placeholder address or something. Random addresses are also somewhat problematic too when they ask me to “confirm my email”. But they just think I have a very strange username.
- growt 4y ago
  Yes I had that from time to time, but I just tell the truth and tell them that their email will automatically get sorted in my inbox and that I get everything @domainname. I imagine thats easier than explaining your email is really 7ahe8Rz2@domainname.com
hawski 4y ago
The usual benefit is that it makes it unguessable. If someone knows your mycatchalldomain he can guess valid e-mail addresses. That way you can be reasonably sure that if someone else is sending e-mails to a specific address the address got leaked.
- growt 4y ago
  Spammers will guess anyway. And I happily trade the chance that some spammer guesses <servicename>@ for the convenience that I don't have to look up every single (spam-)email that I get. Maybe if a service would do some kind of "translation" I would consider using it (like this apple service or duckduckgo's email).
  - bin_bash 4y ago
    1Password has Fastmail integration that maps the random email back to the service: https://1password.com/fastmail/ https://1password.com/fastmail/ Downside is you have to use 1password AND fastmail obv.
- memco 4y ago
  I started thinking of usernames as less secure passwords and therefore randomizing them a few years ago but never thought about the possibility of randomizing the email too. Not only does it help on the spam side of receiving mail but it can help on the login security front since knowing your email address no longer eliminates 33-50% of your login details. It sounds like this is a great enhancement in almost all cases: automated email randomization that is service dependent and also username randomization when you have a site with separate username than your email.

purerandomness 4y ago

1) Web site's user names are typically much more restrictive than passwords. 2) You typically want your user name to be recognizable by the community you're registering at.

neogodless 4y ago

Have you done a signup where the email address is used as a username? Or email address is required? The email address username generation is useful for those cases (assuming you use unique email addresses for each signup.)

crenwick 4y ago

For one, its built right into the UI so you can generate a name and save it in the bitwarden username field in the same motion. Also, the password generator isn't configured to work for the use cases here (adding your email or a catchall, using less characters, no special characters, etc.). That way you can still sign up for accounts that require email verifications.

gpa 4y ago

I'm not a security expert, but possibly being able to change my username in addition to changing my password due to safety concerns gives an extra layer of security.