With the recent surge in compromised user information on web services, I have the following solution in place for myself:
- Registered a domain with an obscure domain name. (actually a bunch)
- One email account with an obscure name
- This email account is the catch-all for the domain
- Now I register for online accounts with any "random_email_address@abscure_domain"
- If the account / address is compromised, any attempt to access the emails linked to this email address is useless, since it is not linked to an account.
Except the usual dependency on the hosting service provider's security, what are the risks to my solution? I am thinking about security and privacy risks.
(Please don't state the obvious inconveniences of dealing with a catch-all)
The key risks I am trying to mitigate:
Many online accounts --> one registered email address. If someone gets hold of that "one" email account via brute force attack or other means, they would have access to all other accounts via password resets.
Using the same email address everywhere enlarges the attack surface for spam / phishing / spear phishing.