Is it dangerous to delete my email account?

Question

If I delete an email from a popular provider (Gmail), would it be possible for somebody to register a new email account under the same name and use it to steal my identity? For example, my email address is [email protected] and after it is deleted the name becomes available again so the attacker registers the same address - [email protected].

Not only would that person be able to impersonate me by sending emails from an address that belonged to me but also access accounts that were previously created with that email account (if they had any knowledge of where I was registered in, because the inbox would be empty, or they could also try logging in on popular websites like Facebook or Ebay to see if they return "no account with this email address" or "wrong password") and access them (by using "I forgot my password" links that send the link to reset the password to the email that is now in control of the attacker).

Answer 1

Yes, any provider that allows old emails to be reused opens you up to accounts registered with that email being recoverable.

Attackers can already spoof the email From: field, but there are mitigations in place, especially with a provider like Gmail. So registering your abandoned email would be a significant win for an attacker, if their goal is to impersonate you.

Using PGP to sign your emails would help with the impersonation aspect, but not with the account recovery attack.

You also never know if your email provider will change their policy in the future, to allow reusing old emails. If you want them to stop retaining your emails, this does put you in a complicated position.

Answer 2

You have highlighted one of the issues with using an address on someone-else's domain. As the other answer says, you can never know if a provider will change their policies in the future in order to recover name-space.

Thankfully it is easy and cheap to avoid this issue. Simply register your own domain name and always use that. Then you are free to change mail providers without loosing contact and without allowing others to impersonate you.

It costs a few dollars a year to have your own domain.