Comment by ravenstine | Hacker News Reader

Comment by ravenstine | Hacker News Reader

Parent Full thread

> Also it requires you to remember usernames or email addresses used at each website. For the last 8+ years I've been using unique usernames and emails at each website. I also have to deal with a number of systems that require me to change passwords every 3 months and I don't want to also be remembering dates.

Interesting idea, but that seems like overkill to me.

Like, yeah, if I was to sign up for Ashley Madison, it would be ideal for me to use an email that is not my known one. ;) But in most cases I don't think that's adding much extra security. If anything, you're more likely to lose access to a site by forgetting what your super secret email for it was than from someone hacking it.

This isn't to say that I'm totally against it. Part of me just feels like there's more that can go wrong doing it that way.

Those of us using a different random username and/or email address for each sender do it for two reasons:

1. If whichever identifier is used for login (eg. email address) is exposed/leaked, it cannot be used by the attacker to lookup accounts in other leak dumps.

2. It allows to detect which site/service/entity is selling or leaking email addresses to third parties which send spam. I no longer need or have a spam folder. The moment I receive a spam email from someone I don't recognize, I can lookup which site/service that email was for, and choose how to act; eg. update that site/service's to use a new email address and blackhole the old one; maybe unsubscribe/close the offending account if it happens again. Of course since setting up my unique-email-per-site setup, I haven't been victim to third-party spam yet; likely because I no longer have a personal email in public Github commits.

> If anything, you're more likely to lose access to a site by forgetting what your super secret email for it was than from someone hacking it.

With a full-featured password manager it's only a matter of backups and remembering your master password. You don't worry about forgetting anything after that's covered.

I think there were also a bunch of social engineering things going on at the time. Things like calling up support and not knowing the password but combining info from different sites and username and email were enough to talk support into doing dumb things. Some of the dumps include things like "First pet's name" and all the common insecurity questions.

Reply on news.ycombinator.com