Some facts about ourselves are difficult or impossible to change, but your email address doesn’t have to be one of them. Switching to a custom email address might seem overwhelming, and it will take some time, but it’s not that hard or expensive (and we’re always happy to help if you get stuck).
Why Consider Switching to a Custom Address?
Why would you want to take on such a task? Independence. If you’re using the email address that came from your Internet service provider, you could end up in an awkward situation if you have to move and switch ISPs. Any address that ends in @comcast.net, @anything.rr.com, @verizon.net, @earthlink.net, or the like could be problematic. You also don’t want to rely entirely on a work email address—there’s no guarantee that your employer will forward email for you indefinitely if you take a different job.
Also, an email address says something about you, much as a postal address does—there’s a difference between an address on Central Park versus one in the Bronx. If you’re not happy with what your email address implies, you might want to switch.
What can an email address reveal? Those with a free Juno, Hotmail, or Yahoo account likely signed up years ago and don’t take email very seriously. People who use an @icloud.com, @me.com, or @mac.com address are clearly Apple users, and those with an address ending in @live.com, @msn.com, or @outlook.com are probably Windows users. .edu addresses identify students, teachers, and school employees—but if you’re not one anymore, your email looks like you’re wearing a varsity jacket in your 40s. The big kahuna of email is Gmail, which boasts about 1.5 billion users worldwide now—as a result, using a Gmail address is fairly generic.
The ultimate in independence comes when you register your own domain name, which usually costs less than $20 per year at sites like 1&1 Ionos, Domain.com, easyDNS, Directnic, and Register.com. Then your address can be anything you want at your new custom domain, and you never again have to worry about being tied to your ISP or associated with a free email host.
How to Change to a Custom Address
Step 1: Register a new domain name. The hard part here is thinking of a name that hasn’t already been taken. It’s best to stick with the traditional top-level domains like .com, .net, and .org—if you get into the new ones like .beer (yes, that’s available), your email is a bit more likely to be marked as spam. Most domain registrars will also host your email for you, and if you go this route, you can skip Step 2.
Step 2: If you’re already using Gmail or another independent email provider that isn’t tied to your ISP, log in to your account at your domain registrar and configure it to forward all email to your existing email address. In this case, you can skip Steps 3 and 4.
However, if you aren’t happy with your current email provider, you’ll need to set up an account with a new one. There are lots, but many people use a paid email provider like FastMail or easyMail that usually charges less than $50 per year and supports multiple mailboxes. When you set up the account, you’ll need to create one or more new email addresses at the provider and configure MX (mail exchange) records with your domain registrar—the service will provide instructions for this.
Step 3: If you’re changing email providers as part of this process, you’ll need to configure Mail—or whatever email client you’re using—to connect to your new email account with the login credentials you set up. That’s not hard, but being able to send email that comes from your custom address can require some effort with the free email providers. Gmail provides instructions, and others that support this feature will as well. Unfortunately, iCloud won’t let you send email using a custom address.
Step 4: If you’re moving to a new email provider, you’ll need to forward your mail from your old provider to your new custom address. Most email providers and ISPs have a screen somewhere in the account settings of their Web sites that lets you enter a forwarding address.
Step 5: Tell your family, friends, and colleagues about your new email address, and update mailing lists and accounts at sites like Amazon that send you email. The forwarding you set up in the previous step will ensure you don’t miss anything during the transition, but remember that if you cancel your old ISP account, that forwarding may end immediately, so it’s important to start the process well in advance.
The details will vary depending on your choice of domain registrar and email provider, so again, if you would like additional recommendations or assistance in setting all this up, just let us know.
A significant danger to businesses today is phishing—the act of forging email to fool someone into revealing login credentials, credit card numbers, or other sensitive information. Of course, phishing is a problem for individuals too, but attackers more frequently target businesses for the same reason as bank robber Willie Sutton’s apocryphal quote about why he robbed banks: “Because that’s where the money is.”
The other reason that businesses are hit more often is that they have multiple points of entry—an attacker doesn’t need to go after a technically savvy CEO when they can get in by fooling a low-level employee in accounting. So company-wide training in identifying phishing attempts is absolutely essential.
Here are some tips you can share about how to identify fraudulent email messages. If you’d like us to put together a comprehensive training plan for your company’s employees, get in touch.
Beware of email asking you to reveal information, click a link, or sign a document
The number one thing to watch out for is any email that asks you to do something that could reveal personal information, expose your login credentials, get you to sign a document online, or open an attachment that could install malware. Anytime you receive such a message out of the blue, get suspicious.
If you think the message might be legitimate, confirm the request “out of band,” which means using another form of communication. For instance, if an email message asks you to log in to your bank account “for verification,” call the bank using a phone number you get from its Web site, not one that’s in the email message, and ask to speak to an account manager or someone in security.
Beware of email from a sender you’ve never heard of before
This is the email equivalent of “stranger danger.” If you don’t know the sender of an email that’s asking you do something out of the ordinary, treat it with suspicion (and don’t do whatever it’s asking!). Of course, that doesn’t mean you should be entirely paranoid—business involves contact with unknown people who might become customers or partners, after all—but people who are new to you shouldn’t be asking for anything unusual.
Beware of email from large companies for whom you’re an anonymous customer
Attackers often forge email so it appears to come from a big company like Apple, Google, or PayPal. These companies are fully aware of the problem, and they never send email asking you to log in to your account, update your credit card information, or the like. (If a company did need you to do something along these lines, it would provide manual instructions so you could be sure you weren’t working on a forged Web site designed to steal your password.)
Since sample email from large companies is easy to come by, these phishing attacks can look a lot like legitimate email. Aside from the unusual call to action, though, they often aren’t quite right. If something seems off in an email from a big company, it probably is.
Beware of email from a trusted source that asks for sensitive information
The most dangerous form of this sort of attack is spear phishing, where an attacker targets you personally. A spear phishing attack involves email forged to look like it’s from a trusted source—your boss, a co-worker, your bank, or a big customer. (The attacker might even have taken over the sender’s account.) The email then requests that you do something that reveals sensitive information or worse. In one famous spear-phishing incident, employees of networking firm Ubiquiti Networks were fooled into wiring $46.7 million to accounts controlled by the attackers.
Beware of email that has numerous spelling and grammar mistakes
Many phishing attacks come from overseas, and attackers from other countries seldom write English correctly. So no matter who a message purports to come from, or what it’s asking you to do, if its spelling, grammar, and capitalization are atrocious, it’s probably fraudulent. (This is yet another reason why it’s important to write carefully when sending important email—if you’re sloppy, the recipient might think the message is fake.)
One of the best ways to train employees about the dangers of phishing is with security awareness testing, which involves sending your own phishing messages to employees and seeing who, if anyone, falls for it. Again, if you need help doing this, let us know.
Many Apple users rely on mac.com, me.com, or icloud.com email addresses, along with plenty of other iCloud-related services. So if you can’t send or receive email, if photos aren’t transferring via iCloud Photo Library, or if some other iCloud-related service isn’t responding, the first thing to do is check Apple’s System Status page. It’s updated every minute, and if it shows that the associated Apple service is having problems, you know to sit tight until things come back up. If everything is green, you’ll have to look elsewhere for a solution—or get in touch with us.
Have you gotten an email message whose Subject line says something like “Change your password immediately! Your account has been hacked.”? If not, it may be only a matter of time before you do. It’s a scary message, especially because it contains one of your passwords, some threats, and a demand for money. Worse, the password is likely one you’ve used in the past—how could the hacker have discovered it? Has your Mac really been taken over?
Relax. There’s nothing to worry about.
This “blackmail spam” has been making the rounds on the Internet recently—we’ve heard from several clients who have received it, and we’ve gotten copies too. The message purports to be from a hacker who has taken over your Mac and installed spyware that has recorded you visiting Web sites that aren’t exactly G-rated. The hacker also claims to have used your Mac’s camera to photograph you while you’re browsing said non-G-rated sites and threatens to share those pictures with your contacts and erase your drive unless you pay a ransom using Bitcoin.
This blackmail spam has raised so many pulses because it backs up its claims by showing a password that you’ve used in the past. Hopefully, it’s not one that you’re still using, because it was extracted from one of the hundreds of password breaches that have occurred over the past decade. Impacted Web sites include big names such as Yahoo, LinkedIn, Adobe, Dropbox, Disqus, and Tumblr—thieves have collectively stolen over 5.5 billion accounts. It’s all too likely that some old password of yours was caught up in one of those thefts.
Concerning as the message sounds, all the details other than your email address and password are completely fabricated. Your Mac has not been hacked. There is no malware spying on your every move. No pictures of you have been uploaded to a remote server. Your hard drive will not be erased. In short, you have nothing to worry about, and you should just mark the message as spam.
However, if you’re still using the password that appeared in the message, that is cause for concern. It means that any automated hacking software could break into the associated account, and it must be a weak password if the bad guys were able to decrypt it from the stolen password files. Go to Have I Been Pwned and search for your email address. If it shows up for any breaches, make sure you’ve changed your password for those accounts.
As always, we recommend that you create a strong, unique password for each of your Web accounts. The easiest way to do this is to rely on a password manager like 1Password or LastPass to generate a random password. Then, when you want to go back to that site, the password manager can log you in automatically. It’s easier and more secure.
If you’re still concerned about your passwords, call us and we can help you get started with stronger security practices.