Hacker News Reader

Comment by 8organicbits | Hacker News Reader

They don't mention it, but there's a privacy benefit to generating usernames. Most users are predictable/lazy and will use the same username on every website. However, tools exist for finding accounts across services that have the same username. Generating a unique username and storing it in your password manager would make it easy to evade these tools.

https://github.com/topics/username-search

I use different usernames per-site, but I tend to take a couple seconds to think of something (hopefully) clever.

View on HN

> I use different usernames per-site

Do you also use a different email address on each site, or do all the unique usernames ultimately link back to one email?

Sometimes.

I think an important distinction is that the email address is often private. My HN account and my reddit account may have the same email address, but Reddit and HN would need to coordinate to figure that out. If they both sell user data, or suffer database breaches, get subpoenas, then a third party could link the accounts. For sites that support username search by email address or treat email address as public data, yeah, that's exposed.

For usernames: a series of HTTP GETs can find likely examples of username reuse:

* news.ycombinator.com/user?id=$username

* reddit.com/u/$username

* twitter.com/$username

This is cheap, easy, scalable, has automated tooling, etc. So I worry enough to pick a new username, and let my password manager remember it.

I use a different email address on each site (though usually the same username).

Many services today use emails as their userid, and even often the login username (account display name being separate), so I think it's probably more common for attackers to match passwords with common emails rather than common usernames. But they can & will still do both, so the unique username certainly has some use.

To defend against password stuffing attacks, I use unique passwords per site (saved to password manager, for convenience). Using a unique email address could help, but I wouldn't trust it. Determined attackers could try your stolen password against a large number of accounts to find where it works.

Ha. No no, I do of course use unique passwords per site. Distinct emails is just defense in-depth.

(it also helps a lot with tracing who's sold your data to a spammer)

Let's say your domain name is example.com

> Distinct emails is just defense in-depth. > (it also helps a lot with tracing who's sold your data to a spammer)

Not only that, if when you first sign up with BigCo you give them your email address as bigco@example.com then when one eventually stops dealing with BigCo one be certain that all email addressed to bigco@example.com can be rejected at your email server without a second thought, no need to scan for spam, just reject everything addressed to that alias.

A good friend of mine takes this a step further and does it through DNS (which of course he self-hosts as well as his mail server). He would give his email to BigCo as firstname@bigco.example.com. Once he's done with BigCo then he removes the records for bigco.example.com and there's no way to even look up a relevant mailserver to send email to firstname@bigco.example.com!

It seems like most websites use your email address as the username, which makes this more difficult. You could use + addressing, which makes it unique, but doesn't really make it private... really need hidemyemail or something similar!

I do wish this was easy and automated.

Check out Firefox Relay and the corresponding Firefox extension. You can pre-register some-random-string@mozmail.com, which will forward e-mail to your actual address. If you pay for it, you'll have your-own-subdomain.mozmail.com, which acts as a catch-all, and you can use without pre-registering any-address@your-own-subdomain.mozmail.com.

You can reply from all addresses described above. The FF extension makes pre-registration of random addresses a little easier by putting a button on e-mail form fields.

There isn't convenient integration with password managers, that I know of.

You could be de-anonymised. Particularly by correlating your sign-ups using your-own-subdomain.mozmail.com. Or if the service is hacked. There's some argument that makes this service harder to generate spam with, and therefore less likely to be blocked. That's yet to be seen, I suppose.

> There isn't convenient integration with password managers, that I know of.

Fastmail also offers this service, so I think it's becoming a popular enough idea that password managers may start to see value in introducing it. Hopefully...

Fastmail actually has 1password integration for their "masked" emails. https://www.fastmail.com/1password/

I have been very happy using fastmail as my email provider and 1password as my password manager. They have an integration which allows you to generate masked emails, which makes what you're describing possible.

This. It’s one of those sticky features that keeps me on 1P, but as soon as bitwarden matches it Im out.

Looks like we’re getting really close.

> I do wish this was easy and automated.

It is, on MacOS and iOS. HideMyEmail works for normals, and Sign-in w/ Apple defaults it on.

The tools I linked rely on usernames that are public. I think most sites that use email addresses as usernames don't make the email address public (think of the spam). Are there example sites I'm forgetting?

true, but most of those sites have a separate field for "display name". No one want's their email address to be tagged on each post. :)

That's a valid argument if your threat model only involves other visitors who aren't given access to see email addresses, but it breaks down if you're hiding from the site administrators, an attacker who obtains admin access, and whomever the attacker makes the data available to.

You can still often check to see if someone has an account for a service by just .. trying to sign in or retrieve lost password. You often don't need to have the password or access to the email to tell from the response if there's already an account registered for that email address.

Run your domain email and use product@your.domain

If it's a privately used domain, then tools could be modified or built to monitor that (if this approach becomes popular or if an individual becomes targeted, possibly other reasons).

Approaches for randomly generated usernames are probably the best way to go. DDG's @duck.com email service (and similar) is pretty fantastic if you're forced to use an email.

Bad: sebastianmiller+product1@email.host sebastianmiller+product2@email.host

Good?: product1@sebastianmiller.ismyrealname product2@sebastianmiller.ismyrealname

Maybe don't use your real name are your domain name?

I generate a unique username for every website I register on, and an unique email too. What I have been doing is using the passphrase generator in Bitwarden as an username generator.

And you're so sure they're being lazy and not because they purposefully want to maintain the same handle across different platforms? The hubris...

No, poor word choice on my end.

Reply on news.ycombinator.com