3 ms·
It should be a standard practice to have a unique email and password for every service you use out there, plus the usual like 2FA. I have been doing this for ye
by tamimio 9mo ago
It should be a standard practice to have a unique email and password for every service you use out there, plus the usual like 2FA. I have been doing this for years and never had any issue, but also you can tell if the service got compromised even if they never announced it. For example, I have an account on a service called Shakepay, and recently I have been getting a lot of phishing attempts on that specific unique email that's never been used anywhere else. I can tell for certain that their email database got leaked/they sold it.
- accrual 9mo agoHow do you manage having potentially many different email accounts?
- jorts 9mo agoJust adding plus signs and the vendor name in the address would do it.
- mmasu 9mo agoisn’t this easy for a potential attacker to mitigate, i.e. dropping from the address everything after the plus? it’s a known trick for gmail so i would not be surprised if an attacker knew how to get to the “real” address by cleaning it up.
- tamimio 9mo agoYes, even some attackers I noticed they excluded all custom domains from their dumps to avoid alerting individuals before they sell it. It’s why it’s better to have a fully unique email, preferably masked one (not custom domains) as some email services provider do, so you get the isolation feature but also blending in without going noticed by attackers.
- tamimio 9mo agoA lot of email services that provide the aliasing feature have seamless integration with password managers, so when you sign up you generate a unique email and password on the fly, and it get saved in the manager.
- lunar_rover 9mo agoOutlook supports having multiple arbitrary email addresses as well as allowing login from only one of them.
- Saris 9mo agoIt's only 1 email account but with either catch-all or aliases configured.