Aliases exit strategy

[win11.shading291]

Can you have an exit strategy for aliases?

By aliases I mean:

Proton Pass / addy.io / duckduckgo email aliases / etc.

@anon77345381

2. The SimpleLogin aliases

These are aliases offered by Proton’s SimpleLogin service, and they serve to compartmentalize your online identity. They are not “disposable”, as they are meant to be permanent aliases. From SimpleLogin’s own FAQ:

SimpleLogin alias are permanent as opposed to the temporary email addresses created on services like temp-mail.org.

SimpleLogin also doesn’t store the emails, they are stored in your mailbox.

SimpleLogin is simply a different product for a different need.

These aliases may look something like google.fasting85@passmail.net (following the pattern <servicename>.<random-word><numbers>@<aliasdomain>. They look nothing like Proton addresses, or like your Proton address, because they are designed for the express purpose of masking it.

SimpleLogin was designed to address what is essentially my threat model: defeating compiling cross-referenced data of a victim through the means of data breaches or data brokers. From SimpleLogin’s own FAQ:

An email alias is random and there’s no way to link 2 email aliases to the same person.

For email aliases created with a catch-all domain, they can only be linked together if the domain is known to have the catch-all option enabled. There’s no way to detect whether a domain has this option enabled or to know how many people are using a domain, a bad actor usually ignores these email addresses altogether.

Further:

If you use a different email alias for each website and one of your aliases starts receiving emails it isn’t supposed to receive, you can be sure that this alias is either leaked or sold.

For example, if your email alias for Facebook receives emails from LinkedIn, that means Facebook has sold your data to LinkedIn or they’ve had a data breach. Either way, you can just disable this alias. Your real email address stays hidden.

Data brokers, a $200 billion industry use your email address as the common denominator to match users between different datasets. Having thousands of email addresses make their job harder and your privacy better.

Given that SimpleLogin aliases are meant to be permanent, by their own statement, and also by practical necessity, the user expects, and rightfully so, that SimpleLogin aliases will be permanent. And they are: when your subscription expires, these aliases remain with the ability to both send and receive, by SimpleLogin’s own FAQ:

When your subscription ends, all aliases you created continue working normally, both on receiving and sending emails. Concretely:

• All aliases/domains/directories/mailboxes you have created are kept and continue working normally.
• You cannot create new aliases if you exceed the free plan limit, i.e. have more than 10 aliases.
• As features like catch-all or directory allow you to create aliases on-the-fly, those aliases cannot be automatically created if you have more than 10 aliases.
• You cannot add new domain, directory or mailbox.

For example, if you have 100 aliases by the time your subscription ends, these 100 aliases will continue receiving and sending emails normally. You cannot however create new aliases.

So when your subscription ends, your SimpleLogin aliases remain functional in perpetuity.

@CitizenPrefix

Beyond the complaint about lack of goodwill (free service) from Proton, OP exposes larger concerns.

• What if Proton went out of business?
• What if the (alias) domains land on the “blocked” list so many companies no longer accept them?

Changing your primary email is bad enough: changing thousands of aliases adds an additional manual step to that process (1. finding the correct alias for the account 2. generating a new alias to replace it).

Using your own domain is not a real solution because:

@CitizenPrefix

I am using my own domain, but OP correctly points out that you lose anonymity/privacy since all your email aliases can be tied to you in aggregate. Even if I used 10 domains it would still break anonymity.

@CitizenPrefix

I’d love to see a discussion about ways around the problem that maintain privacy and durable access independent of the control of others.

So, does anyone have a solution for this?

[ph00lt0]

well for important accounts i have my own domais. So i could always move those and keep receiving the important stuff.
Outside of that aliases i use are not that important to me and I can change them as I have backups of the account passwords.
outside of that I am not really planning to move away ever from in my case proton as I have other users in my visionary accounts too.

[iron_angel]

So you can buy the lifetime Pass + Simplelogin and not have to worry about the price rising. If proton ever went out of business I think we would get lots of warning to be able to transfer out the aliases. I get that there’s some anxiety about this but especially with the lifetime plan all you have to worry about is Proton itself and there’s no way they just disappear one day without notifying people and giving them time.

[ph00lt0]

also thinking. We should not make this seem bigger than it is. It is a very good idea to keep important accounts on your own domain(s) so you can switch but realistically most people have all their accounts on a single outlook/yahoo/gmail account

[dada_goose]

There’s no perfect solution. I think a combination of…

1. Custom domain aliases for accounts you really care about.
2. Random aliases for most other things.
3. Seperate custom domain for all signups that don’t require any other details, such as newsletters.

pretty much is as good as you can get. There will always be that risk of having to change lots of the random aliases at some point but anything you care about will be safe and hopefully lots of those more important services aren’t fingerprinting you and correlating/abusing your data to the same extent as some others.

[Lunar-Pilot]

Instead, may I propose your Alias Entry strategy if you’re so concerned about your aliases on your custom domain being linked to you…

1. Buy a generic “business” domain.
2. Create a dummy business website.
3. Create aliases that look like employee names.

• mohammed.ali@nexaflow-solutions.com
• maria.garcia@nexaflow-solutions.com
• zhang.wei@nexaflow-solutions.com
• james.smith@nexaflow-solutions.com
• li.wang@nexaflow-solutions.com
• michael.johnson@nexaflow-solutions.com
• ahmed.mohamed@nexaflow-solutions.com
• chen.zhang@nexaflow-solutions.com
• robert.williams@nexaflow-solutions.com
• suresh.patel@nexaflow-solutions.com

4. Keep track of aliases in your password manager
5. Use catch-all email forwarding and then create filters or sieve script to assign to folders with the name of the service/provider that they’re used for.

Have fun growing your business empire!

If you decide to migrate email providers, just copy/paste your filters and sieve scripts.

Go ahead and roast this strategy

[depikom]

I use custom domain and don’t expose info about me on whois (it’s registrator’s generic data)

[donutfreak (DF)]

As not every site uses an email address as username, I store my email address for each account in an extra field in my password managers.

Side benefit of if an alias happens to enter into a spam farm, I can likely assess who leaked it, and also change the dozen or so places that use it and retire it.

[mooseberg]

I use a combination of custom domains + SimpleLogins for stuff I don’t care as much about losing access to.

Also, while it’s theoretically possible to correlate that the custom domain belongs to you, what’s the likelihood? It seems like more of a risk to a high target individual IMO, less of a concern if you’re just worried about general surveillance

[Grapeg]

My exit strategy is that I manually change the email address on all of my accounts.

A bit ploddy but I think safer and more private/secure than custom domain aliasing.

[arise1984]

Custom domain are my solution to be fully portable. It’s registered to my irl legal name, renewal paid for max 10 years plus +1 every year so at any given time it got 9-10 years before expiring. Not perfect because nothing is perfect, but i reckon thats as good as it could get.

[Polymer7229]

If you want better email anonymity, you share a domain with many others (the more, the better). Because of that, you as an individual have no control over that domain — that’s a given.

A good approach is to pick a reliable provider and hope they will:

• Have many domains so not all are blocked at once
• Tell you if they’re winding down their service, changing their policies, or other significant changes

Providers with 5–10+ years of history are more likely to have those capabilities; Proton, Fastmail, etc., may fit this category.

You can spread risk by using multiple providers at once, but that can get expensive. However, many of them offer limited free services you can use to spread risk on a smaller scale.