171–180 of 204 posts
Earlier quoted context omitted.
Ohhh good point. So many sites basically only accept gmail + some other popular provider.
I‘m following this scheme for years now and frankly never found a site that only accepts selected providers.
Been doing this for years, and surprised he didn't seem to mention the other benefit: "infinity" email addresses. Oh, rando burger spot wants an email for some free fries? Great, hit me up at randoburgerspot@"mydomain".com .
Gmail has a limited version of this. It leaks your real address, but it makes filtering easy. + @gmail.com steve+randoburger@gmail.com
Migadu allowed me to use - instead, so firstname-*@ also ends up in my inbox (firstname@).
Earlier quoted context omitted.
I do this, too - but I've been running into more and more companies that block you from using their company name in the email address. It also results in awkward conversations if you have to talk to staff. I had ordered some pet supplies online a while ago registered like this. Then I go in store more recently and they ask "Do you have an account with us?", I give them that email when asked, which causes them to paus…
Same experience, but a different perception. I’ve always found it to be a great conversation starter when I did this with my business domain. Of course, it’s mainly about spam control, but some people even felt flattered to have their own personal email address. Then there was that one time I tried to open a new bank account using bankname@mydomain - it ended up involving three levels of management. On the bright sid…
Also can we have things like 2FA in banking apps? I am pretty sure...
Like my idea of thinking is to create a new proton account just for banking and doing the thing as in the article and not really ever linking the two of them or maybe even having a google account if proton causes any issue for my banks.
Earlier quoted context omitted.
I‘m following this scheme for years now and frankly never found a site that only accepts selected providers.
A lot of asian genai startups are pretty picky and want emails from bigger providers. kling, qwen, hunyuan just to name a few.
Earlier quoted context omitted.
I got a LOT more confused looks, especially because I stupidly used a subdomain for this purpose. Imagine like, burgers@e.abc.co.uk when someone is expecting an @gmail.com. If I could think of an unambiguous .com, .net, or .org that is a pronounceable word that wasn't registered already by 2001, I'd be maybe willing to try this again.
Same here. I have a .dev tld (Ooh ahh very fancy). My email is [first]@[last].dev . The amount of times they go "@ gmail?" Is astonishing. These are people who all day, countless times per day, for countless years, are collecting emails (front desk clerks, support reps, whatever), and not one email in the history of emails is the format blah@blah.blah@gmail.com, but somehow they think mine is. Should've just stuck wi…
Not to mention that I've been told by a couple people that they find it to be an awkward email address. Sending to "me" from their perspective should mean sending to themselves.
Been doing this for years, and surprised he didn't seem to mention the other benefit: "infinity" email addresses. Oh, rando burger spot wants an email for some free fries? Great, hit me up at randoburgerspot@"mydomain".com .
That's good but make sure you don't lose the domain. Ever.
Earlier quoted context omitted.
If the secrets are routinely copied or otherwise extracted, then it reduces their security value. What I recommend people do is buy two or more and set them up all at the same time. It is inconvenient though.
I suppose I should have preemptively made that argument and then argued against it. My point is that there should be a mechanism to extract key material in an encrypted form. The backup could only be restored onto properly-prepared hardware (either by way of a device master key held under escrow by Yubico, or by an initial "seed" set by the user when commissioning the hardware). Setting up multiple keys at the same t…
After setting them up, I store one or more at various other locations. The core services people use them for rarely change, and adoption outside of those important services is slow. Even if you only kept one at home and one on your person at all times, this might mean a key would survive something like a house fire.
If given the choice between a hardware token and a passkey, I would prefer the former since it is almost impossible for it to be tampered with (especially without physical access to it).
I do see your point about HSMs and see why people would want such features (especially if there are multiple interested parties involved).
Been doing this for years, and surprised he didn't seem to mention the other benefit: "infinity" email addresses. Oh, rando burger spot wants an email for some free fries? Great, hit me up at randoburgerspot@"mydomain".com .
I've occasionally pondered some sort of phone app that that can dynamically create a random new forwarding email, and keep track of what purpose it was for and who you shared it with.