Isn't this the entire point of GDPR in the EU? To prevent corporations and individuals from using your personal data for any purpose other than for the reason your provided it.
Perhaps you should change your strategy? Personally, I use myname+website@gmail.com as then I'll know the source, when I find my email address has been sold to a 3rf party
I use something similar but without the downside of the "+[...]@domain.tld. Some website don't allow email addresses with the "+" and, as mentionned in this thread, the "+..." can be stripped easily.
I use one of my domain name with a catchall address at my email provider. Everytime I have to signup on a website or IRL with an email address, I just use "website-url@mydomain.com" or "company@mydomain.com". I maintain a simple blacklist of all the throw away emails that have been abused over the past 25 years. I have set up a rule on the email server to delete all messages addressed to any of these blacklisted addresses. This is very effective at cutting down spam.
Downside : when you get a real human from a real company on the phone or IRL. Usually, they don't understand why you have "their-company@a-domain-they-dont-know.com". But it was never a major issue for me.
Your account didn't get hijacked because you didn't set up a phone number or because you didn't read your recovery emails. Your account got hijacked because you reused a password or installed malware, and didn't set up 2FA. There was no "spam vs security" trade-off here.
Not setting up the account with sufficient recovery options is responsible only for your inability to recover it, not for the hijack itself.
On author's defense I don't think twitter should ask for a phone number for recovery (or for any reason) It is only making things harder for people like OP
6 comments
[ 2.7 ms ] story [ 23.8 ms ] threadPerhaps you should change your strategy? Personally, I use myname+website@gmail.com as then I'll know the source, when I find my email address has been sold to a 3rf party
Why would anyone keep "+website" after obtaining your address for illicit purposes?
I use one of my domain name with a catchall address at my email provider. Everytime I have to signup on a website or IRL with an email address, I just use "website-url@mydomain.com" or "company@mydomain.com". I maintain a simple blacklist of all the throw away emails that have been abused over the past 25 years. I have set up a rule on the email server to delete all messages addressed to any of these blacklisted addresses. This is very effective at cutting down spam.
Downside : when you get a real human from a real company on the phone or IRL. Usually, they don't understand why you have "their-company@a-domain-they-dont-know.com". But it was never a major issue for me.
Not setting up the account with sufficient recovery options is responsible only for your inability to recover it, not for the hijack itself.