Re:Disqus Security Alert: User Info Breach
by cm2187 on Saturday October 07, 2017 @02:17AM
(#15422510)
And to provide different email addresses for every website, so that your identity is difficult to correlate between accounts, which partially mitigates the privacy implications of a breach, and fully mitigates the spam / phishing consequences (since you can delete that email alias).
[ Parent
| on HN ]
Re:Disqus Security Alert: User Info Breach
by always_good on Saturday October 07, 2017 @02:26AM
(#15422540)
Generating forwarding email addresses is something password managers like 1Password should do. They should generate a new username, password, and email per service in one click as you please.
Thanks to social engineering, email address reuse is the new password reuse.
Re:Disqus Security Alert: User Info Breach
by j7ake on Saturday October 07, 2017 @03:02AM
(#15422658)
Thanks for your suggestion, but I am not sure how to implement this in practice? How do you generate different email addresses for different websites for a typical user who uses gmail?
Re:Disqus Security Alert: User Info Breach
by cm2187 on Saturday October 07, 2017 @03:13AM
(#15422685)
I run my own domain and the mail server I use does that for me (smartermail). If you don't control your domain there must be third party services. I googled "free email alias", most results seem to be for temporary aliases, but there must be a service for permanent aliases. It's something major providers like gmail should provide.
For some websites, you can put a "+" sign and whatever you want after your gmail username. For example:
[email protected], and you will receive mails at [email protected].
Unfortunelately, this doesn't work with websites that have aggressive regexp checking on email fields.
Re:Disqus Security Alert: User Info Breach
by j7ake on Saturday October 07, 2017 @03:42AM
(#15422769)
I don't see the benefit of using [email protected] if the point is to obscure your email address
Re:Disqus Security Alert: User Info Breach
by zeristor on Saturday October 07, 2017 @06:38AM
(#15423227)
Not everyone realises that'+' is a valid character in an email address, at least not when I tried this several years ago.
If you don't want bots to try email+password from a leak on a bunch of websites, it's good enough, but I agree on the fact that it won't hide your identity.
Re:Disqus Security Alert: User Info Breach
by cm2187 on Saturday October 07, 2017 @03:14AM
(#15422688)
Plus it leaks your underlying email address so it offers very limited protection. Also you can't delete the alias to stop any future spam/phishing.
I think with gmail it's possible to filter based on which alias it was sent to.