[acmecorps]

Good idea on (2). I have a gmail account, so I just use [e-mail]. Pretty handy.

[tonmoy]

If a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain

[ethbro]

Same argument for port knocking. Absolutely ineffective against targeted attacks, but most attacks aren't customized and targeted.

[EdHominem]

It also cuts down on the attack surface enough to let you use more active alerting.

[rzzzt]

"service1" could be generated randomly as well, and stored along with the password in a password manager.

Another nice property of this suffix is that one can identify who gave away their email address / which site it was scraped from when receiving spam; not sure where I have seen this written down originally.

[drdaeman]

I think when spammers see a "+" they just strip everything after it down, i.e. [e-mail] -> [e-mail]. Not to say many sites just don't accept "+" (or, worse, cease to accept such addresses).

Unique, non-guessable, machine-generated addresses are the way to go (do with emails just like password managers do with passwords), but no common person can use those, because they'll need a domain and self-hosted MDA.

E.g.

    $ echo "$(echo -en "secretsalt\nsome.example.net" | sha1sum -b | xxd -r -p | base36 | cut -c-8)@me.example.org" 
    [e-mail]

Or just generating random IDs and maintaining the database.

(Sure, HMAC would be a better idea than this string concatenation, but meh...)

[tonmoy]

Then I could just make my rand(service1) chars larger. No point in adding it to email address at all. Email leak (privacy) is an issue that this could help with but I do not see any benefit in terms of securing my account

[lukasm]

How do you generate new emails? Say, I see a new websites I need a new email? What do you do? Is there a chrome extension that can do it with one click?

[StavrosK]

I use 33mail.com. You just give them a new email address, no need to generate. For example, [e-mail]

[stephengillie]

My personal domain is set to forward all email to my Gmail. Since Google is my registrar, it's expectedly simple to configure this. I haven't setup outbound addresses; services rarely need email sent to them, and replying from my Gmail hasn't caused me any problems yet.

[robotmlg]

Gmail doesn't need any config. Add whatever you want to your usual email after a + and it'll just work

[lukasm]

Yeah but doesn't prevent the attack. Username is still in the email address. Ideally I'd like <domain>+<nonce>@gmail.com that forwards all to my email.