Card 17Practical tips

These tips replace none of the previous chapters. They come on top, once unique passwords and 2FA are in place.

17.1 One address per service, with the Gmail « + »

Gmail accepts anything you add after a « + » in your address. The messages all land in the same inbox.

first.last+facebook@gmail.com
first.last+instagram@gmail.com
first.last+bank@gmail.com

Two concrete benefits. You can create one Gmail filter per service. And if spam ever shows up on « +facebook », you know exactly which service leaked or sold your address.

Gmail ignores dots too: first.last@gmail.com and firstlast@gmail.com are the same inbox.

17.2 Better: Hide My Email

With an iCloud+ subscription, Apple generates a different random address for each service, forwarding to your real one. It gives away nothing about your real address, and you can switch it off if the service starts spamming you.

It is also what « Sign in with Apple » offers on supported sites and apps.

17.3 Your own domain name, with Proton Mail

With a domain name of your own and a mail service that can host it, such as Proton Mail, you create as many addresses as you want, in whatever format you want.

facebook+123@mydomain.com
bank@mydomain.com
shop-2026@mydomain.com

Proton Mail's « catch-all » mode delivers to your inbox anything sent to your domain, even an address you never created. So you invent the address at signup time, with nothing to configure beforehand.

The advantage over the Gmail « + » : if an address leaks or drowns in spam, you delete or block it and hand the service a new one. Your real inbox never appears in the signup form.

17.4 One address reserved for sensitive accounts

Create an address you never publish, never give to an online shop, and use only for your important accounts: bank, Apple account, recovery address.

An address that does not circulate receives far fewer phishing attempts.

17.5 Answer security questions with nonsense

« The name of your first pet » is often findable on your social media. Answer with a random string and save it in your password manager, like a second password.

Question: name of your primary school
Answer  : 7Kq-vento-42-Lm

17.6 Hide notification previews on the Lock Screen

By default, a login code received by SMS can be readable without unlocking the phone.

17.7 Turn on the SIM PIN

If your iPhone is stolen, the SIM card can be moved into another phone to receive your two-factor SMS. A SIM PIN blocks that.