Hacker News Reader

Comment by nannal | Hacker News Reader

I am unclear of the benefits of doing this as opposed to just using the password generator prompt and using it for a username. Seems fairly pointless as a feature to me.

In addition, in the extension I can't use pass-phrase like generated responses for my username but I can for the password?

View on HN

1) Web site's user names are typically much more restrictive than passwords.

2) You typically want your user name to be recognizable by the community you're registering at.

For one, its built right into the UI so you can generate a name and save it in the bitwarden username field in the same motion.

Also, the password generator isn't configured to work for the use cases here (adding your email or a catchall, using less characters, no special characters, etc.). That way you can still sign up for accounts that require email verifications.

Have you done a signup where the email address is used as a username?

Or email address is required? The email address username generation is useful for those cases (assuming you use unique email addresses for each signup.)

I agree, right now I mostly use <servicename>@<mycatchalldomain>.com as usernames, that way I can directly see when something arrives at <servicename>@ that should not. I don't see the benefit of "randomizing" the <servicename> part.

Just curious, where do you host your catchall email domain?

Nice try

Not OP, but thought I'd chip in since I do the same since I left Gmail.

I just use a random cheap domain, registered through Gandi. This includes a couple of 3 GB mailboxes each with unlimited aliases, which is quite adequate if you don't use your email as a file store (much).

I suppose the "right" way would be through something like Fastmail instead, but the simple arrangement above has worked fine thus far.

I also use Gandi somewhat, but beware Gandi doesn't allow catch-all. It does allow, however, wildcards in aliases, which allow a semi-catchall, since alias have to have a minimum of two characters besides the asterisk.

It doesn't seem popular (here at HN, like Fastmail) but the bang for the buck from NameCheap "private email"[0] is pretty solid. I started using them years ago as an alternative to GoDaddy for domain names, and more recently for hosting my email. At little as $1.24/month for a 5GB mailbox with custom domain names / catch-all.

They use something called Jellyfish for spam detection and it's been pretty impressive. A few false negatives but overall catches most of it. And you can use their webmail or any IMAP/POP3/SMTP client.

[0] https://www.namecheap.com/hosting/email/

Have you moved a largish email archive from Gmail to Namecheap? I see they tell you to do it with your client but that seems like it might be unreliable when you have gigabytes of mail to move.

I'm moving some email now using Thunderbird. It's slow and I don't have huge amounts (Gmail tells me 1.39GB). I'm sure it's possible but it might take an hour or so.

A bit slow but I don't think it's unreliable. If it is, that's scary because how would I know :)

Just moved a folder with 1037 emails and it has 1037 on NameCheap now. Seems like it moved them all! (And it didn't take too long. It's moving a bunch of subfolders now.)

I do this too but I often have service workers get very confused why their company name is in my email address. In fact I checked into a hotel once and they made me change it since they thought it was a default placeholder address or something.

Random addresses are also somewhat problematic too when they ask me to “confirm my email”. But they just think I have a very strange username.

Yes I had that from time to time, but I just tell the truth and tell them that their email will automatically get sorted in my inbox and that I get everything @domainname. I imagine thats easier than explaining your email is really 7ahe8Rz2@domainname.com

The usual benefit is that it makes it unguessable. If someone knows your mycatchalldomain he can guess valid e-mail addresses. That way you can be reasonably sure that if someone else is sending e-mails to a specific address the address got leaked.

Spammers will guess anyway. And I happily trade the chance that some spammer guesses <servicename>@ for the convenience that I don't have to look up every single (spam-)email that I get. Maybe if a service would do some kind of "translation" I would consider using it (like this apple service or duckduckgo's email).

1Password has Fastmail integration that maps the random email back to the service: https://1password.com/fastmail/

Downside is you have to use 1password AND fastmail obv.

I started thinking of usernames as less secure passwords and therefore randomizing them a few years ago but never thought about the possibility of randomizing the email too. Not only does it help on the spam side of receiving mail but it can help on the login security front since knowing your email address no longer eliminates 33-50% of your login details. It sounds like this is a great enhancement in almost all cases: automated email randomization that is service dependent and also username randomization when you have a site with separate username than your email.

I'm not a security expert, but possibly being able to change my username in addition to changing my password due to safety concerns gives an extra layer of security.

Reply on news.ycombinator.com