Dedicated domain for email registration

Question

With the recent surge in compromised user information on web services, I have the following solution in place for myself:

• Registered a domain with an obscure domain name. (actually a bunch)
• One email account with an obscure name
• This email account is the catch-all for the domain
• Now I register for online accounts with any "random_email_address@abscure_domain"
• If the account / address is compromised, any attempt to access the emails linked to this email address is useless, since it is not linked to an account.

Except the usual dependency on the hosting service provider's security, what are the risks to my solution? I am thinking about security and privacy risks.

(Please don't state the obvious inconveniences of dealing with a catch-all)

The key risks I am trying to mitigate:

• Many online accounts --> one registered email address. If someone gets hold of that "one" email account via brute force attack or other means, they would have access to all other accounts via password resets.

• Using the same email address everywhere enlarges the attack surface for spam / phishing / spear phishing.

Answer 1

The risks are similar to using one email address for various online accounts, minus the risk of having the email address floating around in public.

This means that a brute force (or other) attack from outside by people who need to use the email address is mitigated.

As long as nobody gets hold of the "catchall" email address, it is far more secure than using a publicly known email address. One should never send emails from this account, and it should have any auto replies or read receipts switched off.

Answer 2

Dependency on the hosting provider to secure the email server aside, the only way to mitigate against your email account from being compromised is by taking the standard precautions.

Only sign up to trusted websites and have good password hygiene. I.E change it regularly, make it complex do not use the same email/password combo on the sites you sign up to. You could also set up aliases for the email addresses to add a bit obfuscation.

If you are using one email address as a catch all, then never use that account to sign up to anything, if you have your own email server just make multiple email address, and forward all the mail to the catch all address from them.

Answer 3

• If the account / address is compromised, any attempt to access the emails linked to this email address is useless, since it is not linked to an account.

• Many online accounts --> one registered email address. If someone gets hold of that "one" email account via brute force attack or other means, they would have access to all other accounts via password resets.

If your mailbox is compromised, the attacker has access to all email addresses, they are all linked to the same mailbox. To achieve really separated email accounts, you have to create one mailbox per account. However, this needs much more effort.

The main advantage is to detect spam/phishing attacks easily, and you know which service has passed the data to a third-party or has been compromised. Also, blocking unwanted mails is easier per address.

You can also use the + syntax in email addresses to achieve a similar effect: user+example.net@example.com The part after the + (called recipient delimiter) is arbitrary. But not all mail providers support it.