Expatriotic on Nostr: _Beginning excerpt from my recent post:_ ### Privacy and Security **Email isn't ...
_Beginning excerpt from my recent post:_
### Privacy and Security
**Email isn't private.**
Gmail/Outlook exist to monetize communication, not protect it. Sure Proton Mail uses PGP between users and Tuta uses quantum encryption for contacts, calendar, and archived emails and allows users to password-protect emails. But both fail when emailing non-users. Messages get decrypted and stored indefinitely. Ready to be served up to whatever alphabet agency requests it. Or simply queried by any staffer within Google or Microsoft who has a bone to pick with an ex-girlfriend.
**Reusing an email address is insecure.**
Attackers gather data from the dark web. Building information from data brokers and then building profiles on potential victims. Just by combining from a few data breaches, a hacker can get a full picture of your life. Your email address, phone number, past passwords, address, passport or ID etc.
### The solution:
Stop reusing one to two to three email addresses for ALL of your accounts.
A hodgepodge of free services could be used if you prefer a cheaper approach.
So this would look like using disposable emails by Guerrilla mail or obvious aliases created by using free accounts with Simple Login or addy.io work most of the time, but are inappropriate for some purposes.
E.g., if you want to have access to an email for a long time, a throw-a-way Guerrilla mail wouldn't work. Or maybe you don't want to give someone you know or a business you interact with an obvious (and often not very aesthetically pleasing addy.io or Simple Login alias.
But I'll explain what to do if you want what I consider the top tier approach.
Enter the custom Domain
This requires you to spend some money to acquire the domain, but that can later be used if you ever want to launch a website (e.g., mine is "expatriotic.me" which I've started using for my blog.
I prefer this as a solution because it works for every case. It works for the throw-a-way cases, the mid-term cases and even the long-term cases where you plan to retain this relationship and keep the email address active for a long time.
With this method every account gets its own email address. A custom domain (e.g., you@yourdomain.io) allows you to create yourbank@..., yoursocialmedia@..., to infinity and beyond. And whereas with the hodgepodge approach you need to spin up the alias when needed, using a custom domain allows you to use a "catch-all" function where you can have someone email you or sign up for an account WITHOUT needing to spin up an alias. ANYTHING before the domain is a valid and viable email address. This is represented with an asterisks. So that would mean that *@yourdomain.io are all valid. You can then use the aliasing service to deactivate or delete compromised or frequently spammed addresses instantly. In fact at the top of EVERY received email there is a line at the top that says, "such-and-such alias received this email, would you like to deactivate it"? So no more fighting to unsubscribe from certain places.
One side benefit of the method below is that you can avoid the normal spam box hell that occurs when emails accumulate from entities that do not include an "unsubscribe" url at the bottom of the email. Banks seem to have this problem the most. My doxxed email address still gets emails from old bank accounts that are impossible to unsubscribe from.
Originally posted
At my blog https://expatriotic.me
and SN (npub1jfu…m0gx) https://stacker.news/items/888316/r/expatriotic
#privacy
#security
#email
### Privacy and Security
**Email isn't private.**
Gmail/Outlook exist to monetize communication, not protect it. Sure Proton Mail uses PGP between users and Tuta uses quantum encryption for contacts, calendar, and archived emails and allows users to password-protect emails. But both fail when emailing non-users. Messages get decrypted and stored indefinitely. Ready to be served up to whatever alphabet agency requests it. Or simply queried by any staffer within Google or Microsoft who has a bone to pick with an ex-girlfriend.
**Reusing an email address is insecure.**
Attackers gather data from the dark web. Building information from data brokers and then building profiles on potential victims. Just by combining from a few data breaches, a hacker can get a full picture of your life. Your email address, phone number, past passwords, address, passport or ID etc.
### The solution:
Stop reusing one to two to three email addresses for ALL of your accounts.
A hodgepodge of free services could be used if you prefer a cheaper approach.
So this would look like using disposable emails by Guerrilla mail or obvious aliases created by using free accounts with Simple Login or addy.io work most of the time, but are inappropriate for some purposes.
E.g., if you want to have access to an email for a long time, a throw-a-way Guerrilla mail wouldn't work. Or maybe you don't want to give someone you know or a business you interact with an obvious (and often not very aesthetically pleasing addy.io or Simple Login alias.
But I'll explain what to do if you want what I consider the top tier approach.
Enter the custom Domain
This requires you to spend some money to acquire the domain, but that can later be used if you ever want to launch a website (e.g., mine is "expatriotic.me" which I've started using for my blog.
I prefer this as a solution because it works for every case. It works for the throw-a-way cases, the mid-term cases and even the long-term cases where you plan to retain this relationship and keep the email address active for a long time.
With this method every account gets its own email address. A custom domain (e.g., you@yourdomain.io) allows you to create yourbank@..., yoursocialmedia@..., to infinity and beyond. And whereas with the hodgepodge approach you need to spin up the alias when needed, using a custom domain allows you to use a "catch-all" function where you can have someone email you or sign up for an account WITHOUT needing to spin up an alias. ANYTHING before the domain is a valid and viable email address. This is represented with an asterisks. So that would mean that *@yourdomain.io are all valid. You can then use the aliasing service to deactivate or delete compromised or frequently spammed addresses instantly. In fact at the top of EVERY received email there is a line at the top that says, "such-and-such alias received this email, would you like to deactivate it"? So no more fighting to unsubscribe from certain places.
One side benefit of the method below is that you can avoid the normal spam box hell that occurs when emails accumulate from entities that do not include an "unsubscribe" url at the bottom of the email. Banks seem to have this problem the most. My doxxed email address still gets emails from old bank accounts that are impossible to unsubscribe from.
Originally posted
At my blog https://expatriotic.me
and SN (npub1jfu…m0gx) https://stacker.news/items/888316/r/expatriotic
#privacy
#security