Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am starting to become wary of giving out my email account to anyone, just by doing reconnaissance it is evident how easy it is to pull so much information from a person just by a email,

There is a privacy concern (IMO), as email accounts are associated with social networks, blogs and any other online accounts.

How can I increase my privacy and security when using email accounts? Should I use several hushmail account and forward all emails to my main account (which remains completely private)?

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

As you point out, there are several "classes" of email addresses that sites require, such as:

  1. One-time, or limited-time use where the email address is only used to access the information, but no email is actually sent.
  2. Sites where email is actually sent containing information, but this information is not considered sensitive (eg. social networking)
  3. Sensitive sites (online banking, etc.)

There are as many types of systems in the spectrum that you can think of. My personal system uses these three categories. You may also want to separate "sensitive" sites from actual correspondence with family and friends since breaches on their accounts can percolate to your own. Sensitivity of certain information may warrant their own email accounts.

One-time and limited-use sites use the email address as a login name only. Therefore use services such as 10minutemail.com to generate email addresses for their use. As long as you remember the email address name (or allow your browser to remember it), then you will not need the actual contents of the email account. Or generate a new account each time you need to access information.

Sites which will actually notify you -- and you want to be notified of events -- require an account that you can dedicate to that course. Create another account which you need not worry about. Make use of additional features, if they exist, such as gmail's "+" modifier to help streamline the process as required.

Sensitive sites are the email addresses you can carefully protect against giving out.

Placing these across several systems can help protect against a full breach.

Creating usernames which are uncommon or "random" can help prevent spammers with malicious intent from getting email to you by broadcast attempts. That is spammers may send emails to well-known first names, or well-known firstname/lastname combos) at domains to see if anything gets through (bob@example.com or smith.jones@example.com). As with any security solution, obscurity is not security, but it can provide a veil of darkness that the average malicious user will have trouble penetrating.

share|improve this answer
add comment

Just a note: you're working at cross-purposes with the design of email.

Email addresses are designed to be given out to people you don't know, who can then email you without having an established relationship.

Various email providers support uniquifying or one-time email addresses, which can help cut down on spam, but if your email address is known to someone else, there's nothing to stop them publishing or otherwise making that known (whether intentionally or not).

An email address alone shouldn't be a privacy risk per se, as long as you understand that email is not an authenticated medium. Getting information from/about someone via email isn't just about having their email address, it's about getting them to reply in some way.

If an email address has been used on a social network and that network hasn't been configured for extreme privacy, the problem isn't the email address, it's the social network.

share|improve this answer
add comment

You can create different mail accounts, which is what I do, to accommodate different types use.

I have an account with my information I use for everything personal. I have one I use professionally. These contain my name or initials.

If it's in any way dodgy I use a disposable email account on guerrilla mail or mailinator. Because I know I will never get anything useful there. The names can be randomly generated by gmail.

If it is something I might need some day, I just have a separate gmail account for support. You could do this as well for social networks. I use something random here as well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.