11

If I delete an email from a popular provider (Gmail), would it be possible for somebody to register a new email account under the same name and use it to steal my identity? For example, my email address is abc@gmail.com and after it is deleted the name becomes available again so the attacker registers the same address - abc@gmail.com.

Not only would that person be able to impersonate me by sending emails from an address that belonged to me but also access accounts that were previously created with that email account (if they had any knowledge of where I was registered in, because the inbox would be empty, or they could also try logging in on popular websites like Facebook or Ebay to see if they return "no account with this email address" or "wrong password") and access them (by using "I forgot my password" links that send the link to reset the password to the email that is now in control of the attacker).

  • 2
    I think most mail providers avoid re-using addresses, but not all. – paj28 Sep 30 '16 at 15:57
4

Yes, any provider that allows old emails to be reused opens you up to accounts registered with that email being recoverable.

Attackers can already spoof the email From: field, but there are mitigations in place, especially with a provider like Gmail. So registering your abandoned email would be a significant win for an attacker, if their goal is to impersonate you.

Using PGP to sign your emails would help with the impersonation aspect, but not with the account recovery attack.

You also never know if your email provider will change their policy in the future, to allow reusing old emails. If you want them to stop retaining your emails, this does put you in a complicated position.

4

You have highlighted one of the issues with using an address on someone-else's domain. As the other answer says, you can never know if a provider will change their policies in the future in order to recover name-space.

Thankfully it is easy and cheap to avoid this issue. Simply register your own domain name and always use that. Then you are free to change mail providers without loosing contact and without allowing others to impersonate you.

It costs a few dollars a year to have your own domain.

  • there may also be costs for email hosting too – DeveloperACE Jul 5 '18 at 7:38
  • Indeed. Though there are many free options including GMail and Outlook.com Not many free options will allow custom domains of course. Swiss based Migadu has a free starter plan with custom domains and paid plans from $4pm. – Julian Knight Jul 12 '18 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.