Hacker News Reader

Comment by gregmac | Hacker News Reader

> The thing I hate about password managers is I am afraid I would stop knowing my passwords.

That is a feature. The handful of passwords I know are mostly long passphrases. The rest are long random strings, generally up in the 30-something character range.

In fact, I don't even know some of my logins anymore: I will use or at least append random characters to most accounts that don't have any 'social' functions (that I care about). I also use a unique email per site.

If an account is compromised, it's got a very low chance it'll even connect to another account I own (at least not without human interpretation), and zero chance of helping with cracking any of my other passwords (other than hinting you can skip guessing anything <30 characters).

I have backups of my password file, I have email recovery (to a domain I own) - knowing individual accounts is just unnecessary.

View on HN

How do you have unique emails per site?

Not OP, but just a guess: you can use tags in your email (add `normal-email+tag-here@domain.org`) and it should go to the same location. If you host your own mail or have your own domain with an… M record? I don’t know—then you can easily create as many emails as you want and forward them to other accounts.

Some overly strict checks on some websites don't allow tags, but if you host yourself there's also the possibility to use `normal-email@whatever.domain.org`. Pretty convenient for filtering.

I have a domain just for emails, so any mail sent to the domain goes to me, so I can just sign up for a site as hackernews@mydomain.tld or whatever system i want for naming stuff. I still get every mail to the same mailbox, but if I start getting spam, I know which site sold my email, or got hacked.

I've been doing that for over a decade. It's great. If I get a phishing email about my iCloud account, but it's sent to my yahoo@mydomain.com then it's obviously a phishing attempt, not need to check for other markers. You can also see who has sold/leaked your email address for marketing purposes.

I use a catch-all subdomain (like *@something.mydomain.com) that simply forwards to my main account. I then sign up on sites using something like news.ycombinator.com@something.mydomain.com or hackernews@something.mydomain.com.

I've been doing it since ~2001. The only downside is long e-mail addresses, but my password manager deals with that for the most part.

Subdomain is important, otherwise you get dictionary-style spam email attacks (as well as everything coming to whoever owned the domain before you, if anyone). I've never noticed that style of attack to the sub-domain.

I've also got very little actual spam to this. A handful of e-mail addresses were obviously leaked/sold but by far the bulk of the spam I get comes to my primary e-mail address which I never use to sign up for anything.

Reply on news.ycombinator.com