>One other interesting aspect of doing a per-company email is that you find companies you might never suspect of selling your data spamming you, or otherwise su

>One other interesting aspect of doing a per-company email is that you find companies you might never suspect of selling your data spamming you, or otherwise subject to data breaches that they never announce. Yeah, definitely. I find this a lot with point of sale terminals. I think it's Square where if you choose an email receipt, they automatically share your email address with any vendor where you use the same credit card. >I did try out random characters as well, but if it's too long it becomes a pain to read out over the phone. Yeah, I don't think you actually need that much entropy though unless you're an especially attractive target. For 99.99% of the population, they have just one email address, so they're an easy target for account enumeration. There'd have to be something unusual about me for an attacker to take such an interest that they special-case my email to recognize my scheme, and even less likely for them to even try to brute force just two random characters (assuming I'm using a secure, random password everywhere). Also, if you haven't signed up, Have I Been Pwned lets you register for notifications at the email domain level with a free account.