> This sort of thing is why every company and every mailing list has a different address for me. Once one is compromised, it goes direct to /dev/null. It's not

> This sort of thing is why every company and every mailing list has a different address for me. Once one is compromised, it goes direct to /dev/null. It's not just a matter of dev nulling something compromised, but also to make it difficult to know where to send a phishing attack to. Troy did half of that. He used mailchimp@_______ for this, so it might have been guessed, or leaked elsewhere, and he won't be able to narrow down which. And if someone sees your facebook@______ leaked elsewhere, it's not a stretch to assume you use mailchimp@_____ or twitter@_____ or... Should use something totally random. Or maybe first 10 chars of hash(servicename + common salt) so you don't have to keep track of too much. Or something similar with encrypt the service name with your GPG key and take the first 10 ascii of the output.