4 ms·

Thanks for reading! >I've considered moving away from this pattern for security though. If someone targets me, they can easily work out my email address for an

Thanks for reading! >I've considered moving away from this pattern for security though. If someone targets me, they can easily work out my email address for any service. Yeah, I do [servicename]-[4-6 random characters]@mydomain.com to avoid this. That way, I can recognize which service the email is associated with on quick inspection, but it's not predictable. The downside is that if I'm talking to a customer service agent in person (e.g., at an airport or hotel) and they ask my email, they're confused about why I don't know it, and I have to look it up on my phone. Also a problem if I don't have network connectivity when they ask.

0x3f 1y ago
I did try out random characters as well, but if it's too long it becomes a pain to read out over the phone. Not unlike masked iCloud emails, which are horrific. Plus the lookup issue you mentioned. I've also considered some kind of word-based approach. Similar to the old XKCD correct-horse-battery-staple passphrase idea, since words tend to be less ambiguous when read aloud. I also wondered if it was possible to do this (a) deterministically from the company name/domain, (b) with an algorithm I can do in my head [to solve your lookup issue], and (c) with some kind of 'salt' that prevents easy enumeration. One other interesting aspect of doing a per-company email is that you find companies you might never suspect of selling your data spamming you, or otherwise subject to data breaches that they never announce.
- mtlynch 1y ago
  >One other interesting aspect of doing a per-company email is that you find companies you might never suspect of selling your data spamming you, or otherwise subject to data breaches that they never announce. Yeah, definitely. I find this a lot with point of sale terminals. I think it's Square where if you choose an email receipt, they automatically share your email address with any vendor where you use the same credit card. >I did try out random characters as well, but if it's too long it becomes a pain to read out over the phone. Yeah, I don't think you actually need that much entropy though unless you're an especially attractive target. For 99.99% of the population, they have just one email address, so they're an easy target for account enumeration. There'd have to be something unusual about me for an attacker to take such an interest that they special-case my email to recognize my scheme, and even less likely for them to even try to brute force just two random characters (assuming I'm using a secure, random password everywhere). Also, if you haven't signed up, Have I Been Pwned lets you register for notifications at the email domain level with a free account.
  - 0x3f 1y ago
    Yeah of course, it's probably total overkill for the average person. I have some startups/projects though where the accounts are kind of valuable and I just end up getting people to use plus-addressing in the form of [employee name]+[random string]@company.com. That way nobody is going to guess our e.g. checking account/DNS admin/whatever email address, and everyone keeps/manages their own named inbox without extra setup. In the pointless pursuit of neatness though, I still think about the one true email address generation strategy from time to time.

0x3f 1y ago

I did try out random characters as well, but if it's too long it becomes a pain to read out over the phone. Not unlike masked iCloud emails, which are horrific. Plus the lookup issue you mentioned. I've also considered some kind of word-based approach. Similar to the old XKCD correct-horse-battery-staple passphrase idea, since words tend to be less ambiguous when read aloud. I also wondered if it was possible to do this (a) deterministically from the company name/domain, (b) with an algorithm I can do in my head [to solve your lookup issue], and (c) with some kind of 'salt' that prevents easy enumeration. One other interesting aspect of doing a per-company email is that you find companies you might never suspect of selling your data spamming you, or otherwise subject to data breaches that they never announce.

mtlynch 1y ago
>One other interesting aspect of doing a per-company email is that you find companies you might never suspect of selling your data spamming you, or otherwise subject to data breaches that they never announce. Yeah, definitely. I find this a lot with point of sale terminals. I think it's Square where if you choose an email receipt, they automatically share your email address with any vendor where you use the same credit card. >I did try out random characters as well, but if it's too long it becomes a pain to read out over the phone. Yeah, I don't think you actually need that much entropy though unless you're an especially attractive target. For 99.99% of the population, they have just one email address, so they're an easy target for account enumeration. There'd have to be something unusual about me for an attacker to take such an interest that they special-case my email to recognize my scheme, and even less likely for them to even try to brute force just two random characters (assuming I'm using a secure, random password everywhere). Also, if you haven't signed up, Have I Been Pwned lets you register for notifications at the email domain level with a free account.
- 0x3f 1y ago
  Yeah of course, it's probably total overkill for the average person. I have some startups/projects though where the accounts are kind of valuable and I just end up getting people to use plus-addressing in the form of [employee name]+[random string]@company.com. That way nobody is going to guess our e.g. checking account/DNS admin/whatever email address, and everyone keeps/manages their own named inbox without extra setup. In the pointless pursuit of neatness though, I still think about the one true email address generation strategy from time to time.