Hacker News Reader

Comment by fluidcruft | Hacker News Reader

Also it requires you to remember usernames or email addresses used at each website. For the last 8+ years I've been using unique usernames and emails at each website. I also have to deal with a number of systems that require me to change passwords every 3 months and I don't want to also be remembering dates.

I can't remember what the crisis was but it was after Ashley Madison and there had been a series of password databases put up on tor. And also there were some things about people getting harassed across platforms. It happened right before I moved to a new state and when I set up all my new utilities and banking and etc I used a password manager and created unique username flavors. Like fluidcruft253b for water and fluidcruftAdaG for gas and fluidcruft563d for banking etc.

View on HN

> Also it requires you to remember usernames or email addresses used at each website. For the last 8+ years I've been using unique usernames and emails at each website. I also have to deal with a number of systems that require me to change passwords every 3 months and I don't want to also be remembering dates.

Interesting idea, but that seems like overkill to me.

Like, yeah, if I was to sign up for Ashley Madison, it would be ideal for me to use an email that is not my known one. ;) But in most cases I don't think that's adding much extra security. If anything, you're more likely to lose access to a site by forgetting what your super secret email for it was than from someone hacking it.

This isn't to say that I'm totally against it. Part of me just feels like there's more that can go wrong doing it that way.

Those of us using a different random username and/or email address for each sender do it for two reasons:

1. If whichever identifier is used for login (eg. email address) is exposed/leaked, it cannot be used by the attacker to lookup accounts in other leak dumps.

2. It allows to detect which site/service/entity is selling or leaking email addresses to third parties which send spam. I no longer need or have a spam folder. The moment I receive a spam email from someone I don't recognize, I can lookup which site/service that email was for, and choose how to act; eg. update that site/service's to use a new email address and blackhole the old one; maybe unsubscribe/close the offending account if it happens again. Of course since setting up my unique-email-per-site setup, I haven't been victim to third-party spam yet; likely because I no longer have a personal email in public Github commits.

> If anything, you're more likely to lose access to a site by forgetting what your super secret email for it was than from someone hacking it.

With a full-featured password manager it's only a matter of backups and remembering your master password. You don't worry about forgetting anything after that's covered.

I think there were also a bunch of social engineering things going on at the time. Things like calling up support and not knowing the password but combining info from different sites and username and email were enough to talk support into doing dumb things. Some of the dumps include things like "First pet's name" and all the common insecurity questions.

Reply on news.ycombinator.com