Threat-model your inbox: which relationships deserve a separate address?

A threat model in plain English

A threat model is simply a way to ask four questions before choosing a defence:

1. What do I care about?
2. What could go wrong?
3. How likely and harmful would that be?
4. Which precaution is worth the effort?

You already do this when you carry an umbrella under grey clouds but do not build a storm shelter for every walk. Inbox privacy benefits from the same sense of proportion.

The goal is not maximum defence everywhere. It is the right defence where it matters.

What are you protecting?

Your inbox contains more than messages. It holds account-recovery routes, links between parts of your identity and access to people who expect to reach you. It also holds your time and attention.

Different relationships threaten different things:

• A mailing list may create noise or sell an address.
• A breached shop may connect a purchase to your identity and invite phishing.
• A bank account carries serious recovery and fraud consequences.
• A public profile may attract scraping, harassment or impersonation.

Calling all four “email risk” hides the useful differences between them.

Four useful address tiers

1. A private recovery address

Keep one stable address away from public forms and casual signups. Use it only where losing access would be especially costly. Protect it with a unique password and strong multi-factor authentication.

2. A durable per-service alias

Use a separate, lasting address for banks, utilities, shops, social accounts and subscriptions you expect to keep. It should survive as long as the relationship and be replaceable if exposed.

3. A short-lived address

Use a temporary route for a download, a trial or an unfamiliar form. Do not use it where you may need password recovery months later.

4. A public contact address

An address printed on a website should be treated as public infrastructure. Expect scraping and unwanted mail. Keep it separate, filter it carefully and never make it the only key to an important account.

The thirty-second decision card

Before giving out an address, ask:

• Will I need to recover this account later?
• Would exposure connect two identities I want kept apart?
• Can I change the address if this company leaks it?
• What happens if the alias disappears?
• How much damage could a convincing fake message cause here?

If recovery matters, choose something durable. If correlation matters, choose something unique. If the relationship is trivial and temporary, let the address be trivial and temporary too.

Knowing when you have done enough

A privacy system that is too complicated to maintain is not a good system. You do not need a different ritual for every website. A few named tiers and a habit of labelling aliases will cover most situations.

Review the choice when the relationship changes. A trial may become essential; an old subscription may become disposable. Threat models are maps, not monuments.