4 ms·
They don't mention it, but there's a privacy benefit to generating usernames. Most users are predictable/lazy and will use the same username on every website. H
by 8organicbits 5y ago
They don't mention it, but there's a privacy benefit to generating usernames. Most users are predictable/lazy and will use the same username on every website. However, tools exist for finding accounts across services that have the same username. Generating a unique username and storing it in your password manager would make it easy to evade these tools.
https://github.com/topics/username-search https://github.com/topics/username-search
I use different usernames per-site, but I tend to take a couple seconds to think of something (hopefully) clever.
- kurthr 5y agoIt seems like most websites use your email address as the username, which makes this more difficult. You could use + addressing, which makes it unique, but doesn't really make it private... really need hidemyemail or something similar! I do wish this was easy and automated.
- b-ryan 5y agoI have been very happy using fastmail as my email provider and 1password as my password manager. They have an integration which allows you to generate masked emails, which makes what you're describing possible.
- skoskie 5y agoThis. It’s one of those sticky features that keeps me on 1P, but as soon as bitwarden matches it Im out. Looks like we’re getting really close.
- Tagbert 5y agotrue, but most of those sites have a separate field for "display name". No one want's their email address to be tagged on each post. :)
- zeven7 5y agoYou can still often check to see if someone has an account for a service by just .. trying to sign in or retrieve lost password. You often don't need to have the password or access to the email to tell from the response if there's already an account registered for that email address.
- hunter2_ 5y agoThat's a valid argument if your threat model only involves other visitors who aren't given access to see email addresses, but it breaks down if you're hiding from the site administrators, an attacker who obtains admin access, and whomever the attacker makes the data available to.
- mekster 5y agoRun your domain email and use product@your.domain
- 6yyyyyy 5y agoBad: sebastianmiller+product1@email.host sebastianmiller+product2@email.host Good?: product1@sebastianmiller.ismyrealname product2@sebastianmiller.ismyrealname
- discardedrefuse 5y agoMaybe don't use your real name are your domain name?
- lcnPylGDnU4H9OF 5y agoIf it's a privately used domain, then tools could be modified or built to monitor that (if this approach becomes popular or if an individual becomes targeted, possibly other reasons). Approaches for randomly generated usernames are probably the best way to go. DDG's @duck.com email service (and similar) is pretty fantastic if you're forced to use an email.
- mkingston 5y agoCheck out Firefox Relay and the corresponding Firefox extension. You can pre-register some-random-string@mozmail.com, which will forward e-mail to your actual address. If you pay for it, you'll have your-own-subdomain.mozmail.com, which acts as a catch-all, and you can use without pre-registering any-address@your-own-subdomain.mozmail.com. You can reply from all addresses described above. The FF extension makes pre-registration of random addresses a little easier by putting a button on e-mail form fields. There isn't convenient integration with password managers, that I know of. You could be de-anonymised. Particularly by correlating your sign-ups using your-own-subdomain.mozmail.com. Or if the service is hacked. There's some argument that makes this service harder to generate spam with, and therefore less likely to be blocked. That's yet to be seen, I suppose.
- lucideer 5y ago> There isn't convenient integration with password managers, that I know of. Fastmail also offers this service, so I think it's becoming a popular enough idea that password managers may start to see value in introducing it. Hopefully...
- yencabulator 5y agoFastmail actually has 1password integration for their "masked" emails. https://www.fastmail.com/1password/ https://www.fastmail.com/1password/
- Terretta 5y ago> I do wish this was easy and automated. It is, on MacOS and iOS. HideMyEmail works for normals, and Sign-in w/ Apple defaults it on.
- 8organicbits 5y agoThe tools I linked rely on usernames that are public. I think most sites that use email addresses as usernames don't make the email address public (think of the spam). Are there example sites I'm forgetting?
- logifail 5y ago> I use different usernames per-site Do you also use a different email address on each site, or do all the unique usernames ultimately link back to one email?
- 8organicbits 5y agoSometimes. I think an important distinction is that the email address is often private. My HN account and my reddit account may have the same email address, but Reddit and HN would need to coordinate to figure that out. If they both sell user data, or suffer database breaches, get subpoenas, then a third party could link the accounts. For sites that support username search by email address or treat email address as public data, yeah, that's exposed. For usernames: a series of HTTP GETs can find likely examples of username reuse: * news.ycombinator.com/user?id=$username * reddit.com/u/$username * twitter.com/$username This is cheap, easy, scalable, has automated tooling, etc. So I worry enough to pick a new username, and let my password manager remember it.
- lucideer 5y agoI use a different email address on each site (though usually the same username). Many services today use emails as their userid, and even often the login username (account display name being separate), so I think it's probably more common for attackers to match passwords with common emails rather than common usernames. But they can & will still do both, so the unique username certainly has some use.
- 8organicbits 5y agoTo defend against password stuffing attacks, I use unique passwords per site (saved to password manager, for convenience). Using a unique email address could help, but I wouldn't trust it. Determined attackers could try your stolen password against a large number of accounts to find where it works.
- lucideer 5y agoHa. No no, I do of course use unique passwords per site. Distinct emails is just defense in-depth. (it also helps a lot with tracing who's sold your data to a spammer)
- soheil 5y agoAnd you're so sure they're being lazy and not because they purposefully want to maintain the same handle across different platforms? The hubris...
- 8organicbits 5y agoNo, poor word choice on my end.
- shaky-carrousel 5y agoI generate a unique username for every website I register on, and an unique email too. What I have been doing is using the passphrase generator in Bitwarden as an username generator.