The joys of owning a short email address

If you have a short email address from a popular email provider, you will surely receive mountains of spam, as well as a lot of alerts that different random people are trying to access it. If your email name is short and attractive enough, this fuss makes your account no longer reliable for day-to-day communications, because important emails will be buried under a mountain of others. However, this situation has an unexpected side: random people periodically use your address as if it belongs to them, and often with rather "sensitive" online services.



About 16 years ago - when you had to be invited to get a new Google accountexisting user - I was able to get a very short email address that no one else has reserved. I will not mention it here, since this will only increase the mountain of spam and the number of hacking attempts, I will only say that it is associated with computer hacking.



Such short account names are called "OG", which stands for "original gangster" [ or "original gametag" / approx. transl. ]. These accounts are valued quite highly in certain circles, whose members try to hack them for personal use or resale. Hence the constant reminders.



However, it never ceases to amaze me at the number of people who think it is a good idea to indicate my email when registering for online services. My account is unwittingly subscribed to almost all existing dating and pornography sites. This was probably to be expected.



What amazes me is the number of financial and other sensitive services that I could access if I were an attacker. My address has accounts that I didn't intend to create with services such as H&R Block, Turbotax, TaxAct, iTunes, LastPass, Dashlane, MyPCBackup, and Credit. I've already lost track of the number of banks, internet providers and web hosts that I can log into.



It never ceases to amaze me how many other Gmail users and other major webmail providers choose to use my address as a backup in case they lose access to their inbox. Almost certainly they were just too lazy and hammered in the name of my address that came to their mind when they were asked about backup mail - apparently not fully understanding the potential problems with this approach. The last time I checked, my address was registered as a fallback in a dozen accounts on Yahoo, Microsoft and other Gmail addresses and their corresponding file sharing services.



If for any reason I want to order food or medicine delivery, my phantom accounts at Chewy, Coupaw and Petco will come in handy. If any of the components of the Weber grill break, I am backed by them. The Weber emails I get from time to time remind me of an article I wrote for The Washington Post many years ago - about companies sending emails from addresses like [companynamehere] @ donotreply.com without thinking about what the domain is to whom something may belong. Some have done this, often with amusing results .



It is probably good that I am not overly addicted to computer games, since it is impossible to list the number of accounts related to games (including gambling) that I have access to through my old mail on Gmail.



For several years in a row, until recently, I received monthly reports for an elderly man from India who was visited by the ingenious idea to use my mail to work with his voluminous retirement savings. Fortunately, after I contacted him, he removed my address from his profile, although he did not answer the question of how this could have happened.



Eventually, I realized that it was better not to ask such questions. Many times I spent several minutes trying to figure out if the email addresses that use my address as a backup were created by people or some kind of spam bots. And then I sent them letters, if they were people, explaining why it was a bad idea, and asking what prompted them to do this.



Perhaps because my Gmail name is associated with hackers, some of the responses turned out to be quite unpleasant. Despite the fact that I attached detailed instructions on how to fix the situation with the letter, one woman from Florida yelled CAPS LOCOM at me, saying that I was trying to deceive her and that her police husband would soon find me. Alas, I still get notifications every time she logs into her Yahoo account.



Probably for the same reason that a lady in Florida mistook me for a malicious hacker, I am constantly receiving requests from random people wanting to hire me to hack other people's accounts. I don’t respond to such letters either, although I admit that sometimes in the process of procrastination, such a temptation appears.



Losing access to your mailbox leads toa nightmarish cascade of other problems . Having a spare email tied to your inbox is a good idea, but obviously only if you control it too.



More importantly, make sure you use the most secure multi-factor authentication option your ISP has to offer. These can be one-time codes sent by mail, phone calls, SMS or a mobile application, or more reliable "two-factor authorization" or 2FA (something you have and something that you know) - security keys or push notifications.



One-time codes sent by email, SMS, or app are considered less secure from a security standpoint because they can be bypassed using a variety of well-developed attack scenarios, from SIM spoofing to mobile viruses. Therefore, it makes sense to use the most reliable multi-factor authentication options. However, keep in mind that even if the site you visit only offers SMS and / or phone calls, it is still more secure than a simple password that you rely on to protect your account.



You may have postponed the issue of enabling multi-factor authentication for important accounts, and if so, visit twofactorauth.org to see if you can improve the security of your records.



As I mentioned in a previous article, "Turn on multi-factor authentication before fraudsters do it for you , "People who don't take advantage of the added protection may find it much more difficult to regain access to their data when their account is compromised - as thieves increasingly enable multi-factor authentication. by tying the account to the device they control.