Hacker News Reader

> They almost never tell you which site was actually breached

That's probably true for most people. But that's what email aliases are for. If I notice (through 1Password alerts) that my me+facebook@mydomain.com email got leaked, I pretty much get an idea which site was breached. At least GMail and Fastmail support email aliasing.

View on HN

I keep using that scheme but it’s been clear for a while that most systems (and hence leakers) clean up those addresses. Which it has to be expected for a feature that has been around for 15 years.

I use `facebook@mydomain.com` instead, which is easy enough to do with catch-all aliases.

Or me+Facebook and block email to me.

Reply on news.ycombinator.com