I can also whitelist some of these private addresses, so that my spam filter can't hide e-mails from services I depend on, no matter who sends them (it can be automated no-reply address, or some support person's address, etc.), so it's not really whitelistable based on the sender. I can't whitelist my public addresses.
It has plenty of benefits with regards to security.
It's basically a secret passphrase you give to a company that it can use to reliably contact you, and that you can use to verify that you're talking with someone you've given this secret to. It's not perfect, but much better than public addresses.
- I have a simple custom web UI for managing mailboxes and aliases in the PostgreSQL database.
- I have postfix/dovecot setup with virtual mailboxes. I avoid DB/postfix interaction by simply dumping DB into a static postfix config files (this is much lighter on resources, than having postfix connect to the database, and much less complicated). I don't use catchall address.
- I use POP3 to get mails from my VPS, to avoid storing archive there, and to avoid having to deal with IMAP in my mail client and filtering scripts
- I use neomutt as a mail client. It has some nice options, like reverse_alias (which I use to display names of my private aliases)
- Neomutt can read configuration from a stdout of some command. I use this to generate aliases and other config options, that make it so that when I reply to something delivered to a private alias, the reply will be sent from that alias too. Using this I can have a single Inbox.
- I filter e-mail using a PHP script (it parses the e-mail, checks the alias database, and decides whether to pass the message to bogofilter, Junk, or Inbox)
Aside from adding aliases to the database, there's no other manual work.
You can probably avoid the database by having some scheme, where address is servicename.[substr(sha256(servicename+secret), 10)]@domain.com and filter/whitelist/highlight on the hash validity.
Of course you may also do this for privacy reasons as well, when your reddit account is leaked do you want that linked to your LinkedIn account?
all the ones in my password manager are
>Are you sure your accounts can’t be broken into with social engineering?
And who's to say that you can't also use social engineering to recover the real email? eg. "I forgot which email I used, but it's on my domain, example.com". This is even more plausible if you use any of the "tricks" that the GP mentioned, like putting random characters, since it further lends credence to your "forgot my email" story.
>Is your password manager infallible?
Considering you have to store all those different emails somewhere, I don't see how this mitigates the treat.
>It’s defence in depth.
Sure, it's defense in depth, but the gains in security is so marginal.
>Of course you may also do this for privacy reasons as well
Sure, I'd buy that aspect, but catchall domains or dot/plus tricks aren't going to cut it because they're relatively easy to deanonimize. Not to mention all the data you leak on those platforms just by using them (location references, friend lists, interests, etc.)
Because an email address is essentially an username.
>Triggering important security processes (eg reset password, social engineering attacks) are trivial once you know someone’s email address.
Sure, but that alone isn't an issue unless you have weak passwords for your email accounts.
>If you want to keep your email address private (you should), generate a new, random email address whenever you give yours out (the same way you use a password manager)
If you're already using a password manager how's that going to provide any additional security? No one is going to crack your 128 bit entropy passwords even if they have your email.