5.2: One Address per Important Thing

One Address per Important Thing

Module 2 gave every account a unique password. This lesson applies the same move to the other half of the login pair. It’s the least-known idea in the course and quietly one of the most powerful: stop giving every site the same email address.

What uniqueness buys you the second time

Remember why unique passwords ended credential stuffing: the leaked pair from site A no longer matches anything at site B. But look at the half the machines still have. Your email address is the constant that lets every combo list connect “you at the shopping site” to “you at the bank.” Make the address unique per site too, and three good things happen:

Stuffing lists miss entirely. The pair that leaks from the pet-supply store is pets-x7q@you... plus a random password. Neither half exists anywhere else. There’s nothing to replay — the machine’s list doesn’t even contain your bank’s username.

A leak identifies the leaker. When spam or a breach notice arrives addressed to the alias you only ever gave one company, you know exactly who lost it, including the companies that never got around to disclosing. Your inbox becomes its own attribution system.

Alerts get surgical. An HIBP hit on a single-purpose alias (5.1) names the affected site by itself. One alias, one site, one password to rotate. A five-minute response with no ambiguity.

Three ways to do it

Plus-addressing: free, works today. Most providers deliver [email protected] to [email protected]. Signing up for a newsletter? you+thatsite@…. The caveat: this is tracking, not armor. The real address is visible before the +, some forms reject the character, and a determined list-cleaner strips it. Fine for spam attribution; not the tool for accounts that matter.

Masked addresses: the real thing. Apple’s Hide My Email, Firefox Relay, and the masked-email features built into password managers generate a truly random address per site ([email protected]) that forwards to your real inbox. The site never learns your real address at all, so it can’t leak it. Your manager records which alias belongs to which login, so there’s no memory burden. It slots straight into the workflow you already have.

Your own domain: for the committed. Owning yourname.com with catch-all forwarding gives you [email protected] for life, independent of any provider. There’s real cost and setup involved. The option exists; most people don’t need it.

Where to apply it

Don’t rush to alias fifty accounts any more than you re-passworded fifty at once. The 1.4 hierarchy applies, with one twist: your master-key email stays your real address, since it’s the identity everything else forwards to. High-value accounts — bank, carrier, cloud — benefit most from masked addresses, because those are the logins stuffing lists most want to find. Then adopt the habit at the margin: every new signup gets an alias by default, and the old long tail converts opportunistically, just like the password migration in 2.4. Six months from now, the machines’ lists will hold a dozen addresses of yours that open nothing and tell you who leaked them.

One practical note: aliases forward to your inbox, so nothing about reading email changes. The only new skill is checking your manager for “which address did I use here,” and autofill already answers that.

Next: the drill for the day a tripwire fires.