The New Oil

Email aliasing is one of the most underrated privacy techniques that has yet to go mainstream. For the privacy-conscious user, it offers a degree of separation between all your accounts, making it harder for data brokers to correlate your various accounts across different services by not using the same email address to sign up. For security, the same technique can also help defeat credential stuffing while obscuring your true email address, which is the central hub where all your identities can be managed (and the email address itself is literally half of the login information a would-be attacker would need to attempt to login). Your inbox is a critical thing to protect since a breach can offer information about additional accounts you have (via the emails already sitting in your inbox like updates, notifications, sign-in verifications, etc) as well as allowing an attacker to simply hit “reset password” on websites where you already have an account and thus take them over. As for mainstream users, the biggest advantage is probably the ability to manage spam more effectively – particularly from companies who refuse to respect opt-out links – from a single inbox, rather than having one inbox for professional use, then logging out and back into another for online shopping, then another for personal or newsletters, and so forth or simply having to give up and hope the spam filters don’t falsely flag anything important (or let junk though). Email aliasing makes effectively managing and controlling your inbox incredibly easy. With that in mind, this week, let’s examine some popular email aliasing services that the privacy community has to offer.

Usual Disclaimer: I have an affiliate link for SimpleLogin that gives me credit on my account if you use it. As always, it would be appreciated should you decide to go with them to help support the project. If you’re uncomfortable doing so, a standard link is provided as well.

To be quite frank, my main two recommendations are incredibly similar in their functionality and user-friendliness. Both allow you to make alias email addresses that forward to your inbox of choice – multiple inboxes, even. Both support PGP encryption if you so desire, both allow use of custom domains or several existing domains, and both are source-available and even allow you to self-host your own implementation if you’d like. The main differences come down to price for the features you want and your opinion of Proton (more on that in the SimpleLogin section). With that said, let’s discuss those differences.

Addy.io

Price: Free, Lite ($1/month), and Pro ($4/month or $36/year)

Addy is a solid offering but unfortunately there a few significant shortcomings that should be noted. First, I don’t believe the free plan is feasible for most users, mainly because it doesn’t allow you to start new emails from an alias or even reply to emails you receive. Even with a paid plan it’s vital to note that Addy still has a daily reply/send limit (20 for Lite and 100 for Pro) as well as a monthly bandwidth limit on the Free and Lite plans (10MB/100M). In other words, if you send a lot of emails – or a lot of large emails, such as attachments – you may quickly run out of bandwidth and find yourself unable to send or receive emails.

However, compared to SimpleLogin, Addy’s strength lies in the free and Lite plans. Even on the free plan, Addy offers unlimited aliases while SimpleLogin offers only 10. Addy also allows PGP encryption at all levels while SimpleLogin restricts this to their Premium plan. Addy’s Lite plan also includes one custom domain and five inboxes you can forward to for a mere $12/year compared to SimpleLogin’s $30 Premium plan, which you would need to unlock those same features. If you’re on a tight budget but you still want a large number of alias email addresses and you’re okay with the limited number of replies and bandwidth, Addy is a solid offering. I would only recommend the Pro plan for people who would prefer not to use SimpleLogin because of their relationship with Proton – for example, people who use Proton as their main inbox and prefer not to have all their eggs in one basket.

SimpleLogin

Non-Affiliate Link

Price: Free, Premium ($4/month or $30/year)

SimpleLogin has long been the most popular choice in the privacy space. At first glance, there are several reasons why. For starters, unlimited bandwidth and replies, even on the free plan. This means that you will never have to worry about not getting an email because you got too many and even the free plan will allow you to reply to an email you receive (though starting a new email chain will require the Premium plan). For another, SimpleLogin’s Premium plan is cheaper than Addy’s Pro plan ($30/year vs $36/year, respectively) while simultaneously offering more (unlimited custom domains vs twenty, unlimited inboxes vs thirty, fifty directories/usernames vs eleven usernames, and SimpleLogin offers subdomains while Addy does not). For those able and willing to spend a few bucks, SimpleLogin’s Premium plan is an obvious choice over Addy’s Pro plan.

That said, there are two caveats to note here. First, as noted in the Addy section, Addy’s Lite plan has a superior offering to SimpleLogin’s Free plan for most popular features. If you’re on a tight budget, Addy’s Lite plan may make more sense than the SimpleLogin Pro plan in some cases. Second, and most important, SimpleLogin was acquired a few years ago by Proton. So far, this has not negatively impacted SimpleLogin at all; they continue to offer an independent service that’s interoperable with any given email provider. If anything, this partnership has greatly benefited Proton as it seems that much of the work on Proton’s new Password Manager seems to have been fueled by the SimpleLogin team, which has resulted in rapid development and an impressively competitive product, not to mention the seamless integration of SimpleLogin into Proton’s suite which has made using aliases effortless for users. That said, even those who trust and use Proton may feel uncomfortable putting all their eggs in a single basket. As such, it might make sense for certain threat models to use Addy instead of SimpleLogin simply to avoid centralizing too heavily on one single company or service.

Honorable Mentions

Whenever possible, I prefer to give users a variety of choices rather than just two. Luckily, we do have some additional options that are popular in the privacy space. It is worth noting that in my opinion, these services are inferior to Addy and SimpleLogin for reasons stated below. I am offering these simply to give readers more choices. Do I think they’re bad choices? No, or else I wouldn’t list them here, but I would recommend checking out the two main options first and only resorting to these if the others don’t meet your needs for some reason.

• DuckDuckGo Email Protection – From the makers of the popular private metasearch engine (and web browser), DuckDuckGo Email Protection offers some excellent features, such as unlimited aliases, tracker remover, automatic HTTPS upgrades, and more, all at no cost to the user. You can sign-up and manage your aliases from any browser on any OS and even reply to emails you receive (it doesn’t appear you can start a fresh email chain), though of course it functions more smoothly with the extension or browser. It should be noted – as stated on my website – that I have lost nearly all faith in DuckDuckGo, at least as a search engine and a browser. At this time I would be open to considering their email aliasing and data removal offerings, but I would proceed with caution given their track record.

• Firefox Relay – Firefox Relay is Mozilla’s offering to help protect users. Like DuckDuckGo, Relay strips email trackers and allows for replies to incoming emails (though you can’t initiate a new conversation). Unlike DuckDuckgo, Relay is a freemium offering – the free plan is quite limited, allowing only for five aliases without blocking trackers. At the Premium tier, Relay also offers a phone number that can you use which forwards to your existing phone number, however I’m told that you can only reply to the latest message you received – for example, if you get a text from Bob and then later you get a text from Alice, your reply will be sent to Alice as she was the most recent person to message you. You cannot choose to reply to Bob. )This information was given to me over a year ago and may be outdated now.) While Mozilla is another company with their share of scandals, Relay has been around for a few years now with no major concerns coming to light. Because of the phone number limitations, I wouldn’t recommend it as a Voice-over-IP service, but the email protection makes it a service worth considering.

• StartMail – StartMail is a private – but not encrypted – email provider. StartMail does not offer a free plan, opting for the philosophy that “if a product is free, you are the product,” thus they would rather charge all users to sustain their product than have to resort to advertising, data mining, and other morally questionable funding sources. What makes StartMail popular in the privacy community is that unlimited email aliasing is built into every plan. In the past year or so since acquiring SimpleLogin, Proton has integrated a similar functionality, but this still requires an Unlimited plan with Proton ($10/month, nearly double StartMail’s $5) to match the same functionality. An important note, however, is that – as I said – StartMail is not what I would consider an encrypted email provider. Decryption takes place server-side in order to be more convenient to users, which means that while you are logged in, your emails are visible to the server and thus to StartMail and anyone else who may have access to that server. This runs counter to how my recommended providers – Proton and Tuta – handle encrypting and decrypting content. While one could make a valid argument that even with my recommended providers you are trusting both providers not to be scanning, data mining, or making copies of your content, I find assurance that at least once the emails are in the vault my inbox is protected from additional intrusion. StartMail cannot make this same guarantee yet still requires the same level of trust, arguably moreso as StartMail is not source-available while Proton and Tuta are.

Conclusion

Whoever you choose to use, email aliasing is a technique I hope to see catch on more. Techniques like email aliasing are the kind of privacy tool I love to share: it has benefits for both privacy and security while offering tangible conveniences that even mainstream users can appreciate and get immediate value from. If you aren’t using email aliasing yet, but sure to check out one of these services to see if it’s right for you. If you are, maybe share this article with a friend or family member who isn’t and see if you can start that conversation. Next time your email gets caught up in a data breach, make sure the impact is minimal with one of these services.

Tech changes fast, so be sure to check TheNewOil.org for the latest recommendations on tools, services, settings, and more. You can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...