AliasFleet account security rests on four practices: a distinct alias for each service, a strong password used nowhere else, two-factor authentication, and regular review of active sessions. This page summarises each practice, the steps to apply it, and the response when an alias receives spam or an unfamiliar session appears.
Only an AliasFleet account is required for the practices on this page. A password manager is useful for storing the account password and two-factor recovery codes, but it is not required.
Why does one alias per service limit breach damage?#
A separate alias for each service confines a leak to that service. When a single alias is used for five shopping sites and one of them is breached, the source of the exposure cannot be identified from the address alone. When each site has its own alias, the alias that begins receiving unwanted mail identifies the source, and only that alias needs to change.
A new alias is created before signing up for a service, rather than reusing an existing one. The habit takes a few seconds, and it is what makes the rest of this page work: deactivating one alias never affects the others.
What makes a strong alias address?#
An alias address that contains a real name gives away more than the address itself. The address john.amazon@yourdomain.com reveals both a name and the service it belongs to, so if it appears in a breach dump it is more useful to whoever finds it. An address such as shop.a3f9k2@yourdomain.com reveals neither. Random characters in place of a name keep the alias usable for its service while giving away nothing about the owner.
How do I set up two-factor authentication?#
Two-factor authentication adds a second check at sign-in, so a password alone is not enough to open the account. In summary, the setup is:
- Open Security settings: Go to Settings, then Security.
- Enable two-factor authentication: Select the option to enable 2FA and choose an authenticator app (such as Authy, Google Authenticator, or any TOTP app) or email OTP.
- Scan the code: Scan the QR code shown with the authenticator app and enter the code it generates to confirm.
- Store the recovery codes: Save the recovery codes shown at setup in a password manager or on paper kept somewhere safe, not in a plain file on the computer. They are the only way back into the account if access to the authenticator is lost.
The full setup, including recovery code storage and recovery from lockout, is covered in Two-Factor Authentication.
How do I choose a strong, unique account password?#
The AliasFleet password is used nowhere else. A compromised AliasFleet password is more damaging than a compromised password for a single shopping site, because aliases for many services flow through the account. A password manager removes the need to remember each password: Bitwarden is free and works across devices, and 1Password is a paid alternative. A long random password is generated in the manager and stored there, rather than reusing a memorable password across sites.
How do I check active sessions?#
Active sessions list every device currently signed in to the account. Regular review of the list catches sign-ins that should not be there. The steps are:
- Open Security settings: Go to Settings, then Security.
- Review the session list: Check each entry for a device and location that matches a real sign-in.
- Terminate anything unfamiliar: End any session that is not recognised, then change the account password.
The full session list and the terminate steps are covered in Active Sessions.
What do I do if an alias starts receiving spam?#
The affected alias is deactivated at once to stop the flow, a replacement alias is created, and the email address on that service is updated. The real inbox address never changes, so only the affected service needs an update and every other alias keeps working. If a data breach is suspected, Have I Been Pwned shows whether that service's data has appeared in a known breach. The check confirms whether the service was breached; it does not change the response, which is to deactivate the alias and replace it.
What do I do if I see an unfamiliar session?#
An unfamiliar session is a device or location that does not match any real sign-in. The response has three steps:
- Terminate the session: End the unfamiliar session from the session list so it can no longer access the account.
- Change the password: Set a new unique password, as covered in Changing Your Password.
- Check two-factor authentication: Confirm that two-factor authentication is still enabled, and enable it if it is not.
If the unfamiliar session appeared alongside a phishing email, the email is treated as untrusted and no link in it is followed.
Will AliasFleet ever ask for a password by email?#
No. AliasFleet never asks for a password or login credentials by email. Any email claiming to be from AliasFleet and asking for a password is a phishing attempt. It is ignored, and it is reported to support if there is any doubt about whether it is genuine.