As a tip: use your AppleID to generate a secondary email that you use for your day to day email, while keeping the login email secret. The problem stems from nefarious groups getting a hold of email addresses and running distributed dictionary attacks. Apple’s response is to prevent all logins (including valid ones) from accounts that are under attack. Unlocking the account involves calling Apple, they’re not going t…
I use [REDACTED] as a provider and I create an email address/account (if possible) per company/domain I interact with (e.g.: personal_github@domain.tld or amazon_personal@domain.tld). This produces two results:
1. No shared credentials across any space.
2. Any junk emails to these addresses immediately tells me who's sold it (or been hacked) and I delete the account[s] and relevant email aliases and get on with my day.
Some services, like Firefox, are starting to offer a form of "hide my email address" but this doesn't solve the problem of using as the same login id across a lot of services. If that was dumped somewhere, it is probably a strong bet someone has used that as their login, elsewhere.
I don't know if there's another viable solution - but this reduction of possible login ids to one unique id per site is the only way I know how to (possibly) prevent myself from being an easy dictionary attack target.
Edit: formatting