As shared in the link, if you want to check if your Tumblr account was compromised check out:
Knowing who leaked your email or sold it to spammers
Being able to stop spam by deleting the email
You could even consider binding the email to a domain so the address would only accept emails from the domain you gave this email address.
You don't really want different mailboxes, you want one mailbox with different aliases. An alias becomes a "communication token" which can be revoked, very much like when paypal gives a payment authorisation token to an ecommerce website. If that token gets leaked, no big deal, no one else can use it. A single email address is more like a credit card number.
The per_site_suffix can be anything you want.
As an industry, I think we need to rethink the way we develop, package, and deploy web apps. The fact that we rely on individual developers and sysadmins to get security right, perfectly, every time is crazy. In an ideal world the prod environment should protect me from shooting myself in the foot, and the OS should be running a hardened-by-default, single-purpose system image that doesn't require bespoke knowledge to make secure.
While far from perfect, I think the PaaS vendors (AppEngine and Heroku) got a lot of things right in this regard. [Disclaimer: I work for Google, but not on Google Cloud.]
But some of the password hashing algos used, no salting, making all password characters lower-case in the background, etc. are not hard things to avoid. So when a site is hacked and the user information stolen and we find that stuff out, it's safer to assume other security practices where also subpar.
A few years after I left, their DB was compromised, so someone got a list of email addresses with clear text passwords.
So when my email gets reissued i'll have to track down every single website it's linked to and purge any personal information etc. Fantastic.
Out of curiosity, what do the usernames (aka local part) of the e-mail addresses look like? Are they based on names/initials? Are they arbitrary?
My high school followed a similar structure, but had the graduating year as a suffix, implying that they would never be reused.
I wouldn't be surprised if this was rampant in educational institutions who have to provision emails to people with identical names all the time.
(those addresses are mine, first the generic ID, then the generic ID [at] faculty, then prefix [at] generic (I don’t have one), then prefix [at] faculty; first comes first serve on prefixes)
I'm not sure what to make of that information, since I know it's not a recycled email address.
For example, D&D Online and Heroes of Newerth both were compromised.
Here's my question...what recourse is there beyond resetting passwords? If a company did something as dumb as store my PW in plaintext, do I have any realistic legal recourse for what seems pretty negligent? I'd assume I'd have to prove damages of some sort, and I am not a fan of an overly litigious society, but it seems there is no real recourse for impacted users.
http://www.businesswire.com/news/home/20160531005770/en/Time...
I've taken to doing the thing they tell you never to do: I write my passwords down on a piece of paper. Criminals can get access to my passwords, but they're going to have to travel to my house to do it.