5 ms·

I think it's a good practice to always use unique, unpredictable email addresses when signing for online services. 1. Most people use the same or similar passw

I think it's a good practice to always use unique, unpredictable email addresses when signing for online services. 1. Most people use the same or similar password, so once one account gets hacked, the attacker is probably able to use many other accounts on different services with the same email address/password combo. 2. It's easier to spot services that spam, or that leak your email address (I became aware of a leak of email addresses on Box... luckily it was only emails that got leaked, at least according to Box support). 3. It's easier to block spam, once a service misbehaves or gives away the email. I wrote a little more about using it as a "passwordless password manager" at http://blog.gingerlime.com/2011/passwordless-password-manager/ http://blog.gingerlime.com/2011/passwordless-password-manage... update: (if blog post is too long...) this does not mean setting up hundreds of different email accounts. On most services like hotmail, google and yahoo you can simply append some unique string to your email address, e.g. john+f820938422@gmail.com. Making this unpredictable is important however, so appending +facebook and +twitter is not helping much though...

bruceboughton 14y ago
So now you need a password manager to remember the email addresses instead of the password. What problem are you solving?
- gingerlime 14y ago
  The problem I was trying to solve is of many people who use the same password and email everywhere, and who won't use a password manager or feel it's too complicated to install or use etc. The email addresses are not as sensitive as passwords. Sure. If someone gets hold of all of them AND your master password you're in trouble. But same goes to getting your password manager file and the password for it. The difference is you don't need a password manager software. You can store this list anywhere which is reasonably safe.
  - bruceboughton 14y ago
    Your scheme is no easier to implement than having a different password for each website. You have effectively moved part of the password out of the password and into the email address.
    - gingerlime 14y ago
      It is only easier in the sense of not having to install or use a password manager, and that the email addresses themselves are not as sensitive as the password. As with everything security related, there is a trade-off. I'm not saying it's more secure, but it can be more convenient in certain circumstances and for certain people. A password-manager is more secure (if the master password is and the manager software is safe). A unique email address + unique password with a password manager even more so. two-factor authentication even more... and so on... It's just a question of options/priorities. This is still a valid option in my opinion which might work well for some people who don't want / can't use a password manager, but can handle a list of random email addresses...
vitalysh 14y ago
Instead of remembering all those weird email names, what you could do is: 1) Buy domain and attach google apps to it. 2) Switch catch-all email setting in preferences. 3) When register for a service use email like skype@domain.com or facebook@domain.com etc.
- Jach 14y ago
  And for sites that don't have insufficiently permissive email regex validators, if you have gmail you can just add a '+' and do youremail+skype@gmail.com, youremail+facebook@gmail.com, etc.
  - vitalysh 14y ago
    Yeah, you could do that as well. I just don't like the idea that someone holds my email address. After reading few stories where Google/Microsoft blocks access to email, I decided to move my email to custom domain. In case of any issues all I have to do is change MX names to new provider to start receiving my mails again.
    - culturestate 14y ago
      You can do the +modifier trick with GApps as well.
      - palebluedot 14y ago
        Yes, but one of the great things about having GApps with your own domain name, is that you are not tied to Google as an email provider, and can easily switch. If you use something like the '+' modifier, then if you switch away you need to switch to someone that supports the same modifier. So if your goal is to maintain email-provider independence, then relying on provider-specific features like the '+' modifier works against that goal. For me though, the main reason I don't use it is most sites that I want to use it on reject the '+' in the address as invalid. It happens enough that I don't bother trying anymore.
reirob 14y ago
Are you suggesting to have a different email address for every online service we use? Today I manage about 100 different unique passwords for every online service. This is already very inconvenient. Adding as well as having different bogus email addresses would be at least 2 times more difficult! I think something is really broken in today's web authentication scheme. I think there is really huge need for some independent and reliable service (Mozilla's Personas maybe).
- deleted 14y ago
  [deleted]
- switz 14y ago
  While I don't necessarily agree with your parent's post, there's a relatively simple solution here. If you're using gmail, you can use the + operator to automatically tag emails. Here, it serves an alternative purpose. For example, if my email is daniel@gmail.com, then I would use daniel+hn@gmail.com when signing up for Hacker News.
  - corin_ 14y ago
    Skipping over the fact that most email providers don't necessarily support this, and that not all websites/services will allow it (not saying they are right not to), this creates a whole new set of things to remember as even something as simple as +hn (which is surely simple enough that anyone could guess it) could be tougher on other sites, e.g. is Reddit +rd, +re, or...?
    - eric-hu 14y ago
      To carry this idea further, the +descriptor email trick has backfired on me before. Sometimes sites require an email login and it takes me several tries to even remember what my +descriptor was. Sometimes, I don't actually remember and just end up going to my inbox to find an email from the site so I can look up what I used. Another time, this backfired on me when I purchased concert tickets using a +descriptor email and couldn't login. The purchase form and login form had different validation rules, so the purchase form accepted my +descriptor email and charged me for it. The login form rejected my +descriptor email and I was rushing to contact customer service to print my ticket in time.
kerridge0 14y ago
what I do is intersperse the site name with my username at my domain e.g. for skype: ksekryrpiedge0@mydomain.com then I have a catch-all on the domain, and lower the priority of emails that aren't to my normal address, but any important emails get their own forwarder to forward into my main inbox, so I will get the emails on my mobile devices. quite effective actually.

bruceboughton 14y ago

So now you need a password manager to remember the email addresses instead of the password. What problem are you solving?

gingerlime 14y ago
The problem I was trying to solve is of many people who use the same password and email everywhere, and who won't use a password manager or feel it's too complicated to install or use etc. The email addresses are not as sensitive as passwords. Sure. If someone gets hold of all of them AND your master password you're in trouble. But same goes to getting your password manager file and the password for it. The difference is you don't need a password manager software. You can store this list anywhere which is reasonably safe.
- bruceboughton 14y ago
  Your scheme is no easier to implement than having a different password for each website. You have effectively moved part of the password out of the password and into the email address.
  - gingerlime 14y ago
    It is only easier in the sense of not having to install or use a password manager, and that the email addresses themselves are not as sensitive as the password. As with everything security related, there is a trade-off. I'm not saying it's more secure, but it can be more convenient in certain circumstances and for certain people. A password-manager is more secure (if the master password is and the manager software is safe). A unique email address + unique password with a password manager even more so. two-factor authentication even more... and so on... It's just a question of options/priorities. This is still a valid option in my opinion which might work well for some people who don't want / can't use a password manager, but can handle a list of random email addresses...

vitalysh 14y ago

Instead of remembering all those weird email names, what you could do is: 1) Buy domain and attach google apps to it. 2) Switch catch-all email setting in preferences. 3) When register for a service use email like skype@domain.com or facebook@domain.com etc.

Jach 14y ago
And for sites that don't have insufficiently permissive email regex validators, if you have gmail you can just add a '+' and do youremail+skype@gmail.com, youremail+facebook@gmail.com, etc.
- vitalysh 14y ago
  Yeah, you could do that as well. I just don't like the idea that someone holds my email address. After reading few stories where Google/Microsoft blocks access to email, I decided to move my email to custom domain. In case of any issues all I have to do is change MX names to new provider to start receiving my mails again.
  - culturestate 14y ago
    You can do the +modifier trick with GApps as well.
    - palebluedot 14y ago
      Yes, but one of the great things about having GApps with your own domain name, is that you are not tied to Google as an email provider, and can easily switch. If you use something like the '+' modifier, then if you switch away you need to switch to someone that supports the same modifier. So if your goal is to maintain email-provider independence, then relying on provider-specific features like the '+' modifier works against that goal. For me though, the main reason I don't use it is most sites that I want to use it on reject the '+' in the address as invalid. It happens enough that I don't bother trying anymore.

reirob 14y ago

Are you suggesting to have a different email address for every online service we use? Today I manage about 100 different unique passwords for every online service. This is already very inconvenient. Adding as well as having different bogus email addresses would be at least 2 times more difficult! I think something is really broken in today's web authentication scheme. I think there is really huge need for some independent and reliable service (Mozilla's Personas maybe).

deleted 14y ago
[deleted]
switz 14y ago
While I don't necessarily agree with your parent's post, there's a relatively simple solution here. If you're using gmail, you can use the + operator to automatically tag emails. Here, it serves an alternative purpose. For example, if my email is daniel@gmail.com, then I would use daniel+hn@gmail.com when signing up for Hacker News.
- corin_ 14y ago
  Skipping over the fact that most email providers don't necessarily support this, and that not all websites/services will allow it (not saying they are right not to), this creates a whole new set of things to remember as even something as simple as +hn (which is surely simple enough that anyone could guess it) could be tougher on other sites, e.g. is Reddit +rd, +re, or...?
  - eric-hu 14y ago
    To carry this idea further, the +descriptor email trick has backfired on me before. Sometimes sites require an email login and it takes me several tries to even remember what my +descriptor was. Sometimes, I don't actually remember and just end up going to my inbox to find an email from the site so I can look up what I used. Another time, this backfired on me when I purchased concert tickets using a +descriptor email and couldn't login. The purchase form and login form had different validation rules, so the purchase form accepted my +descriptor email and charged me for it. The login form rejected my +descriptor email and I was rushing to contact customer service to print my ticket in time.

kerridge0 14y ago

what I do is intersperse the site name with my username at my domain e.g. for skype: ksekryrpiedge0@mydomain.com then I have a catch-all on the domain, and lower the priority of emails that aren't to my normal address, but any important emails get their own forwarder to forward into my main inbox, so I will get the emails on my mobile devices. quite effective actually.