3 ms·

> I use different usernames per-site Do you also use a different email address on each site, or do all the unique usernames ultimately link back to one email?

8organicbits 5y ago
Sometimes. I think an important distinction is that the email address is often private. My HN account and my reddit account may have the same email address, but Reddit and HN would need to coordinate to figure that out. If they both sell user data, or suffer database breaches, get subpoenas, then a third party could link the accounts. For sites that support username search by email address or treat email address as public data, yeah, that's exposed. For usernames: a series of HTTP GETs can find likely examples of username reuse: * news.ycombinator.com/user?id=$username * reddit.com/u/$username * twitter.com/$username This is cheap, easy, scalable, has automated tooling, etc. So I worry enough to pick a new username, and let my password manager remember it.
lucideer 5y ago
I use a different email address on each site (though usually the same username). Many services today use emails as their userid, and even often the login username (account display name being separate), so I think it's probably more common for attackers to match passwords with common emails rather than common usernames. But they can & will still do both, so the unique username certainly has some use.
- 8organicbits 5y ago
  To defend against password stuffing attacks, I use unique passwords per site (saved to password manager, for convenience). Using a unique email address could help, but I wouldn't trust it. Determined attackers could try your stolen password against a large number of accounts to find where it works.
  - lucideer 5y ago
    Ha. No no, I do of course use unique passwords per site. Distinct emails is just defense in-depth. (it also helps a lot with tracing who's sold your data to a spammer)
    - logifail 5y ago
      Let's say your domain name is example.com > Distinct emails is just defense in-depth. > (it also helps a lot with tracing who's sold your data to a spammer) Not only that, if when you first sign up with BigCo you give them your email address as bigco@example.com then when one eventually stops dealing with BigCo one be certain that all email addressed to bigco@example.com can be rejected at your email server without a second thought, no need to scan for spam, just reject everything addressed to that alias. A good friend of mine takes this a step further and does it through DNS (which of course he self-hosts as well as his mail server). He would give his email to BigCo as firstname@bigco.example.com. Once he's done with BigCo then he removes the records for bigco.example.com and there's no way to even look up a relevant mailserver to send email to firstname@bigco.example.com!

8organicbits 5y ago

Sometimes. I think an important distinction is that the email address is often private. My HN account and my reddit account may have the same email address, but Reddit and HN would need to coordinate to figure that out. If they both sell user data, or suffer database breaches, get subpoenas, then a third party could link the accounts. For sites that support username search by email address or treat email address as public data, yeah, that's exposed. For usernames: a series of HTTP GETs can find likely examples of username reuse: * news.ycombinator.com/user?id=$username * reddit.com/u/$username * twitter.com/$username This is cheap, easy, scalable, has automated tooling, etc. So I worry enough to pick a new username, and let my password manager remember it.

lucideer 5y ago

I use a different email address on each site (though usually the same username). Many services today use emails as their userid, and even often the login username (account display name being separate), so I think it's probably more common for attackers to match passwords with common emails rather than common usernames. But they can & will still do both, so the unique username certainly has some use.

8organicbits 5y ago
To defend against password stuffing attacks, I use unique passwords per site (saved to password manager, for convenience). Using a unique email address could help, but I wouldn't trust it. Determined attackers could try your stolen password against a large number of accounts to find where it works.
- lucideer 5y ago
  Ha. No no, I do of course use unique passwords per site. Distinct emails is just defense in-depth. (it also helps a lot with tracing who's sold your data to a spammer)
  - logifail 5y ago
    Let's say your domain name is example.com > Distinct emails is just defense in-depth. > (it also helps a lot with tracing who's sold your data to a spammer) Not only that, if when you first sign up with BigCo you give them your email address as bigco@example.com then when one eventually stops dealing with BigCo one be certain that all email addressed to bigco@example.com can be rejected at your email server without a second thought, no need to scan for spam, just reject everything addressed to that alias. A good friend of mine takes this a step further and does it through DNS (which of course he self-hosts as well as his mail server). He would give his email to BigCo as firstname@bigco.example.com. Once he's done with BigCo then he removes the records for bigco.example.com and there's no way to even look up a relevant mailserver to send email to firstname@bigco.example.com!