28
If using custom domain e-mails, to prevent spam, is it necessary to make addresses unpredictable (e.g.: stem-chaos-stricken@domain), or is servicename@domain good enough? (lemmy.sdf.org)
submitted 2 weeks ago by to c/privacy@lemmy.dbzer0.com
19 comments fedilink hide all child comments
 

Assuming a password manager is used, even jfav0ohjau4gvncgan19@domain should be OK.

On the other hand, I might just be overthinking it. It could even look suspicious to customer support, or is that again just overthinking?

Also, there already will necessarily be some predictable ones, such as work@domain, although servicename@domain would provide even more possible matches.

you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 2 weeks ago (7 children)

I think using servicename@domain would be fine, the common ones like support, webmaster, etc.. are the ones to avoid. And using a unique one per service helps when a service inevitably leaks that email address, you can just change it and block the old one.

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] 11 points 2 weeks ago* (last edited 2 weeks ago) (6 children)

    I actually used to use service@domain.tld but decided to switch because of a few reasons:

    • Using the name of the service as username can make it obvious it’s an email alias and also that the domain is (probably) used by a single person
    • In addition to that, from a security standpoint, it may make it easier for bad actors to get access to your accounts because the email address reveals which service it belongs to

    Depending on your threat model, it’s worth considering something-random@domain.tld instead.

    Edit: formatting

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 3 points 2 weeks ago* (2 children)

    Most spammers aren't reading the list of emails and thinking about it, they're just buying a huge list of emails and spamming them unthinkingly. I've been doing this (putting the company name before the at) for most of this century and the span contagion never spreads to other addresses at my domain.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 weeks ago (1 child)

    Most spammers aren’t reading the list of emails

    With LLMs they don’t have to. I don’t really see a good reason to use service@domain.tld personally, you’re giving away more information with little to no benefit compared to something-random@domain.tld.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 2 points 2 weeks ago

    and also that the domain is (probably) used by a single person

    Currently I am just going with namesurname.tld. If they already know who I am, it doesn't show anything extra. If it's something I don't want linked to me that easily, I can just give it e-mail on some shared domain, and change it later if needed. Though that removes the easy portability.
    I'll probably have more domains eventually.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 weeks ago (1 child)

    Don't you think you're overthinking it? Or did any of your reasons ever come true, so to speak?

    When would it be a problem if someone deduces that your email domain is your own personal one?

    For your other point, do you mean that someone gets access to your email - they actually break into your inbox. If they see you have a mailbox called service@domain.tld, they'll know that's going to be the signup you used for service.com. Is that what you're referring to? Doesn't seem like a big cause for concern to me, so am I missing something?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 weeks ago* (last edited 2 weeks ago)

    I’ve been hacked before, luckily nothing severe happened but ever since then I’ve taken stuff like this a lot more seriously.

    Let’s say I use a self hosted Addy instance, a bad actor knowing that my email is for email forwarding could assume I’m running Addy, which uses PHP, try the recent php2shell vulnerability and potentially execute commands on my server.

    I was thinking of a data breach where it may not be obvious or mentioned which service it’s for, but I’m not sure how realistic that is. 🤔

    Maybe I’m a bit overly paranoid, but In this day and age of LLMs I don’t think that’s a bad thing.

    Edit: rewording

  • permalink
  • fedilink
  • source
  • parent