You Should Know

I second this option. I use it because there's an app that supports the file format for pretty much every platform.

And can use syncthing to sync between your devices

You can also add to that pass which names istelf the "standard UNIX password manager", altough it's just a nice frontend for gpg.

Do you know of a "keepass for dummies"? I've tried to figure out how to use it, but reading the readme on GitHub just makes me feel like an idiot.

I feel like this option is honestly worse for most people. You have the new security problem of having to transfer the file everywhere, but now the huge inconvenience of potentially losing it or not having it on a new device.

duckduckgo.com offer that service too. Using a browser plug in it can generate @duck.com email addresses when signing up to sites and forward them to your standard email address.

Firefox also offers their Relay service, which is hosted by the Mozilla foundation, although I don't believe that the service is open source.

great service for sites that hatenon-standard templates!!

If there are not already people running fediverse nodes that exist specifically to harvest potentially 'interesting' data, there will be.

You edited it? That's maybe interesting. You deleted it? Same deal, maybe interesting.

It looks like an email address? Definitely might be interesting. A phone number? Yep.

An address? Definitely could be interesting.

If you posted it, assume that it will always be available to the exact people that you don't want to see it.

You said, do post. I am sure you meant, don't post.

I wouldn't say don't post personal information at all. But rather don't post information that you're not comfortable with everyone knowing, while being identified and never being able to delete it.

IMO it's best to assume that if you post enough online, someone dedicated enough will be able to identify you, especially people who already know you in real life. It's difficult to post without revealing small details about yourself that can be combined to piece together who you are. Eg, you might never say where you work, but your city, field, an offhand comment about a coworker, a mention of a conference, and such might let someone narrow it down. Similarly, you might never mention what city you're in, but it might be narrowed down from mentions of things like traffic, weather, events near you, remarks of things being close by, etc. And that's not even getting into devious things like trying to trick someone into clicking a link to a domain you control so that you can get their IP.

I'm of the opinion you should generally act as if you're talking to people face to face with a name tag saying your full name and address. I think that approach also just plain makes the internet a better place. Anonymity seems to make a lot of people more comfortable being aggressive assholes.

I say "generally" because there's plenty of valid reasons to want to post things you would want to post things that you'd never say if identified. But in that case, you should strongly consider using an absolutely minimal throwaway account, while being extremely careful with details. And even then, you should at least consider that you might still get identified. In particular, I think a lot of users of throwaways only consider strangers not being able to identify them. Sometimes that's all you care about, but your family, friends, and coworkers are going to have a lot easier time identifying you.

In case you are concerned about giving up a personal email for signup, you can use temporary email generators for signing up for Lemmy as well. There are plenty available.

DDG is great, I've been using it for a while now, but I recently learned that I can also send mails from my main account as a @duck.com address and now I'm in love.

Passwords aren't encrypted? Or you mean if an instance's password leaks, they all leak? Because that applies to everything. Use unique passwords with every account, everywhere.

I do not believe either mastodon or lemmy federate your email address at all. Only the server you join has that information. You might have to worry if you have signed up to an uncrupulous instance. That instance admin could sell your email, I guess. They would have access to any email you gave them, so changing it would probably not help. I think the problem is a little overstated, honestly.

federated users and local users are stored in the database in different tables. The federated users table doesn't have emails saved in it.

My question as well! Since I didn't know this at signup and used my primary email, am I screwed no matter what in the event of unscrupulous data collection?

If they don't use email, how do these instances prevent themselves from being immediately overrun by bots?

Or you could use a temporary email service, though I'm not sure what the services do with the temporary addresses after they expire. If someone knows, please enlighten me.

This is a good explanation of the feature for use with Lemmy.

I’m gonna be an annoying pedant for a second though and say that “hide my email” and “sign in with apple” are two different and unique features, though they both act as an email relay.

The former just creates a semi-random email address for you that forwards to your email. This address will end in “@icloud.com,” making it indistinguishable from any other iCloud email address (other than the ridiculous address you get).

The latter is an authentication system that allows you to sign up for services that support it with your apple account. The service doesn’t get your password directly of course, when you click the “sign in with apple” button it will redirect you to an apple sign in, typically faceID or touchID, and when you sign in successfully (or are already signed in to Apple) it will redirect back to the service with a token that says “this person is cool.”

Importantly for this conversation though, you can optionally send the service your real email or a generated email address as a relay, but the generated email is not the same as the email generated by “Hide my email,” instead it’s a clearly random series of characters and ends in “@privaterelay.appleid.com”.

In the end they have roughly the same purpose for your email, but the important bit here is that on Lemmy, only “hide my email” will be useful. There are no Lemmy instances that support “sign in with Apple” (yet).

Okay, I’ll stop being a pedant now. Sorry for being annoying there.