5

After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security.

We can only do so much too protect ourselves because at the end of the day we have to trust the companies whose services we use to do their part in protecting us.

Nevertheless, I'm curious if using a unique email address for each online service adds a layer of security which increases the difficulty of social engineering attacks.

For instance, instead of using the same email address, e.g. joshu@mydomain.com I would use something such as github_a4f3@mydomain.com or github_cliche@mydomain.com. The _a4f3 part of the email address would be something random that has no specific meaning and makes it harder to guess than just using github@mydomain.com.

Alternatively, instead of some random string, using diceware to add a real word.

Is there any value in doing any of this?

Improve this question
1
  • 1
    Whenever I know my e-mail won't be used as my username, I use an address from www.10minutemail.com to sign up for sites. Just a tip.
    – KnightOfNi
    Feb 5, 2014 at 2:45

5 Answers 5

Reset to default
5

What you are thinking of should provide better security than using a single email address for everything. However, it is a major pain to manage. Major inconvenience is the worst enemy of good security because you will eventually break down and stop following your system.

What you should do is separate your identities. For example, there is no sense in using the same email address for both your Facebook or Twitter account and your bank account. Even worse, there is no sense is using the same email address for personal correspondence and business matters. For example, this guy was using the same email address for both his personal Amazon account and his startup's AWS account. It is generally a good idea to keep distinct identities for this purposes.

Improve this answer
1
  • 1
    A technique that people sometimes use in order to have not too many (to remember/store) email addresses: use separate addresses for important logins, use one for the many other less important sites (forums, blogs...)
    – user13695
    Nov 27, 2014 at 7:43
4

Well sure, it would definitely provide another layer of security.

But realistically it's usually a pain to have a zillion different email addresses, one for each specific account. I prefer having 5-10 that I use for certain categories (e.g. personal, bills, etc.).

Here's a blog post that summarizes the idea quite nicely: https://securosis.com/blog/consumer-security-tip-use-multiple-email-accounts-to-reduce-fraud-and-spam

Improve this answer
2
  • Do you use your own domain for all those addresses?
    – joshu
    Feb 5, 2014 at 14:13
  • Nope, just for my professional account - it's mostly Gmail for the rest. Addresses that aren't associated with your personal domain seem more "anonymous" to me, and Gmail has a pretty good spam filter. YMMV though if you're more concerned about privacy with the email provider itself.
    – Amy S
    Feb 5, 2014 at 23:03
3

With Gmail you can append anything after your email address as long as you add plus character before it. For example, firstname.lastname+anythingyoulike@gmail.com will always deliver emails to your real account firstname.lastname@gmail.com. However, you can still see from headers to which address the email was originally sent to. You can append the site name or just a random string to make it unique to site in question.

Actually, firstname.lastname@gmail.com is the same as firstnamelastname@gmail.com is the same as firstname.lastname+anythingyoulike@gmail.com. GMail will ignore dots and anything after + character. So there's no need to register any new addresses, you can use a single GMail address if you apply these rules.

Improve this answer
3
  • 1
    This is called plus addressing and should work at any email provider, not just Gmail. Further, I believe gmail will also support a hyphen (-) for this purpose.
    – Chris Murray
    Nov 27, 2014 at 8:39
  • This doesn't increase anonymity. Someone could easily figure out the main email address. This is useful for categorization only.
    – André Werlang
    Sep 5, 2018 at 21:34
  • Plus addressing is well known and spammers can trivially remove the added part and use the bare account name, whereas legitimate mailers who keep the address unchanged tend to provide honest sender information and a working unsubscribe mechanism. So plus addressing doesn't really provide much benefit unless you have a way of using a character other than plus for the separator. The same goes for the other trick of adding dots to Gmail addresses.
    – thomasrutter
    Sep 30, 2018 at 22:55
2

I registered one domain name for this purpose, a domain name that has no meaning, not my name in it. I use a catchall for a subdomain. A catchall can be problematic with spam (as they can send it to any address in that domain once it's in their system), but up til now I don't get any. The main domain does not accept mail.

So take the domain xyzmail.info as example. I created MX records for qwe.xyzmail.info, set a catchall, and use that. Now I can use addresses like nyt@qwe.xyzamil.info and twitter@qwe.xyzamil.info etc. If lolcatforum@qwe.xyzamil.info is hacked and my email address is stolen, I would expect spam coming in on this address at some point. Then I can redirect this alias to dev/null or set a rule to trash it. If the subdomain gets listed in spam listings, I could delete it and switch to another.

I could disable the catchall and create an alias for each new newsletter. That's not really usable, unless you can add a new alias with a (secure) one click action.

Do I use it and does it work? I've used this for maybe about 20 newsletters. I've used this once at a shop where they asked me for my address, and this caused a lot of confusion. I had to spell it out 10 times, and then explain why their name was in the address. So for those occasions I decided to use another address. To keep track of all logins I use Lastpass.

Looking back I don't see the point anymore and I guess I will switch back to an alias from my ISP sometime in the future. Gmail is an option. The + after the username in gmail may be a good alternative, but I guess spammers know this too, and may write a script to delete that automatically. Gmail antispam works good, so not a real issue.

I do separate my mail. Private and business is separate. Newsletters never to my private mail. Shopping with separate address. For Paypal, Apple, Amazon and some other really big names I use my private gmail.

Improve this answer
1

This method is untested by me, but here's a suggestion: Try to keep the 'core' services like Google Apps and domain registrars on an alternate set of personal details. Maybe using a secondary home address, secondary phone number, etc. that never gets published on your social network and very few people know about. Of course don't store any credit card numbers on those services either, so an attacker would have to know your secondary details - which is much harder to get to.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.