Your email address is a master key
Forgotten your password? Almost every service will email you a reset link. That convenience means control of an email address is effectively control of every account registered to it.
Normally that’s fine, because only you can receive mail at your address. The risk appears when an address you once used can end up belonging to someone else.
How recycling creates a takeover path
- You create a custom alias, say a readable name for your online shopping, and use it for dozens of accounts.
- Later, you delete it. You update most of your accounts, but miss a few: an old marketplace login, a forgotten loyalty account.
- The service returns the name to the pool of available aliases.
- Someone else registers the same name. They now receive any email sent to it.
- They visit the forgotten sites, click “forgot password”, and the reset link arrives in their inbox.
No hacking is needed. The system works exactly as designed, for the wrong person.
The same problem has been reported with recycled phone numbers, where a new owner of a reassigned number receives the previous owner’s security codes.
Why custom names are the higher risk
Random aliases are long strings that are unlikely to be guessed or requested again. Custom names are different: people choose readable, memorable words, so the chance of someone wanting the same name later is real, and readable names are easy for an attacker to target deliberately.
What Hskky does
When a custom alias on Hskky Plus is deleted, its name goes into permanent quarantine. It is never offered to anyone else, ever. Your old address can’t become someone else’s inbox.
On top of that, every stopped alias is held for two months before removal, so if you realise you’ve missed an account, you can reactivate the alias and update it.
Before you stop any alias
- Search your inbox for mail sent to that alias in the past year to find accounts that use it.
- Update the email address on accounts you still use, or close the ones you don’t.
- Check your password manager for logins saved with that address.
Whatever service you use, it’s worth asking: what happens to my addresses after I delete them? If the answer is that they’re reissued, treat deletion as a security decision. Read how Hskky handles deleted names.