You Should Know

You could add keepassxc as an option for those who don't want a hosted service at all. You can still exchange the storage file with other computers if you have to (via USB stick, mail, nextcloud etc)

Speaking of which, stuff that frequently comes up in privacy related forums:

Differentiate between your professional accounts (it has your real name attached) and your non-professional ones (you use it to discuss pooping methods for example). Don't mix them up. I know many will say "so what if people in the fediverse know where I live and how I poop, I got nothing to hide" a lot, but that's how people got doxxed or swatted.

Even if you don't feel the need to, it's good to sit down and identify the potential threats given certain problems. Do you recycle passwords for email and social media accounts? What about banking? If a malicious coworker or an immature family member got access to your social media profile and posted reputation-damaging content, how bad can things get? Identify the outcomes you can mitigate or must prevent, and plan accordingly.

There is no "100%" when it comes to privacy. It's a process, not an "all-or-nothing" switch. Beginners often ask if "program X and Y will protect me 100%", and the answer usually boils down to "there isn't a single magic pill".

Privacy ≠ Security ≠ Anonymity. A VPN subscription can secure your connection (content secret in transit), but does not make you anonymous (sender known to middle node). You could leave an anonymous message (sender unknown) on a public forum, but the message itself isn't private (content not secret). And so on.

Encryption is a useful tool, but don't fall for the "military grade encryption" speech. They often mean "we just slapped whatever shit it came up with", nothing extraordinary.

There are many more but I will stop for now. No, I am not in Guantanamo.

It’s not very open-sourcey, but Apple include a email forwarding service called Hide My Email in their iCloud+ plans. So, you may already have access to that service.

Also, do not post personal information here ever. Once you posted a comment, there are no guarantee you can fully delete them later. If you post a personal information, there is a chance that it might still up in some instance somewhere even if you attempt to delete it. Some instance might not receive the activitypub push about the deletion due to federation issue/lags, getting blocked from the original instance, bugs or random internet connection issues. Use other channel if you need to share personal info to fellow lemmings so you can be sure to purge them if needed later (e.g a link to pastebin, discord, etc)

I totally agree with using strong unique password manager generated passwords for every server (as everyone should do for every service they use regardless) but my email has been leaked so many times by so many breaches I’m not sure I really care about that part at this point…

When I made my account was the first time I used a Firefox relay account for more than just testing how it worked 😂 didn't even think about the fact that fediverse instances are probably "less secure" or could even be outright malicious from the get. Been using bitwarden for about a year now and honestly I love it as well.

The throwaway email providers I personally use are:

• If I want to receive ongoing messages and have the ability to reset passwords etc: DuckDuckGo
• If I don't care what happens after the first email: Yopmail

Adding on (because I almost did this very, very stupid thing until I stopped and thought for a moment):

If you create accounts on multiple instances with the same username, don't use the same password. Otherwise anyone with access to one has access to all.

You could also use an instance that doesn't require email for signups. Like fmhy or lemmynsfw.

Weird question - if you change your email address, is the change you made, and the old and new email address now federated out to all the other instances, meaning in a hypothetical leak, both email addresses get leaked? Or would only the newest one be saved and federated, and therefore leaked?

Caution: The following requires that you have "Keychain" and "iCloud Mail" activated for your Apple ID, and are running iOS 15+, iPadOS 15+, and macOS Monterey+ on the applicable devices.

For macOS / iOS / iPadOS users you can use "Hide My Email" (aka "Sign in with Apple") to have a randomly generated e-mail address used for sign-ups. Then you can have Keychain generate a random, strong, passcode for you to use on that particular website.

Note: If you see just an "e-mail" field on the sign-up page, and when you click in it you see a drop-down menu of your current Apple e-mail addresses, just scroll to the bottom of that list to get to "Hide My E-mail".

After you've completed a sign-up on a website (not just federated, but any website) Apple will e-mail you the new e-mail address you generated and for which website is was used on. Store that in a safe place to easily keep track of what's being used where. (You can also find them here: System > Apple ID > Hide My E-mail > Options…)

All of the above, the randomly generated e-mail addresses and passcodes for the websites, are automatically synced through iCloud to all of your devices signed into the account used to create them.

Note: The "Sign in with Apple" button is a bit weird. When you've used it on a website, then later go back and are asked to sign-in to your account, you'll see the same "Sign in with Apple" button you saw originally. There's no visual indicator on the page that you've used this feature before. It's not until you select the button that the next screen will show you the e-mail address that was generated.

Ha ok this is fun. I do like this idea for most people. You should sign up with as little information as you need. You still must watch what you say.

I do also think you should have a federated business server before you start posting with your real name/loc

Or get yourself your own domain name, and use a email service provider that can forward all emails of the domain name to one account.