Sometimes.

I think an important distinction is that the email address is often private. My HN account and my reddit account may have the same email address, but Reddit and HN would need to coordinate to figure that out. If they both sell user data, or suffer database breaches, get subpoenas, then a third party could link the accounts. For sites that support username search by email address or treat email address as public data, yeah, that's exposed.

For usernames: a series of HTTP GETs can find likely examples of username reuse:

* news.ycombinator.com/user?id=$username

* reddit.com/u/$username

* twitter.com/$username

This is cheap, easy, scalable, has automated tooling, etc. So I worry enough to pick a new username, and let my password manager remember it.

I use a different email address on each site (though usually the same username).

Many services today use emails as their userid, and even often the login username (account display name being separate), so I think it's probably more common for attackers to match passwords with common emails rather than common usernames. But they can & will still do both, so the unique username certainly has some use.

To defend against password stuffing attacks, I use unique passwords per site (saved to password manager, for convenience). Using a unique email address could help, but I wouldn't trust it. Determined attackers could try your stolen password against a large number of accounts to find where it works.

Ha. No no, I do of course use unique passwords per site. Distinct emails is just defense in-depth.

(it also helps a lot with tracing who's sold your data to a spammer)

Let's say your domain name is example.com

> Distinct emails is just defense in-depth. > (it also helps a lot with tracing who's sold your data to a spammer)

Not only that, if when you first sign up with BigCo you give them your email address as [email protected] then when one eventually stops dealing with BigCo one be certain that all email addressed to [email protected] can be rejected at your email server without a second thought, no need to scan for spam, just reject everything addressed to that alias.

A good friend of mine takes this a step further and does it through DNS (which of course he self-hosts as well as his mail server). He would give his email to BigCo as [email protected]. Once he's done with BigCo then he removes the records for bigco.example.com and there's no way to even look up a relevant mailserver to send email to [email protected]!