Updated on April 6 with reports on a new increase in Gmail spam and a warning that it could be linked to a new update from Google, putting users at risk.
Here we go again. New furor follows Google’s decision to allow Gmail users to change their original email addresses for something less embarrassing or more age appropriate. But this long-awaited update won’t solve anyone’s email problems. And worse, Gmail’s 2 billion users now need new email addresses.
This option to change Gmail addresses is not new. But its high profile is New. The US rollout has drawn attention, not least because Google’s CEO spearheaded the PR campaign. “2004 was a good year, but your Gmail address doesn’t have to be stuck on it,” Sundar Pichai posted. “Say goodbye to v0t3f0rp3dr02004@gmail.com or mrbrightside416@gmail.com.” Now you can “go to your Google Account settings and choose any available name,” though your old username will continue to work.
If the main objective is to move past legacy names, enabling millennials to use school and college email addresses for something more suitable for people with jobs and families, this ticks the box well enough. But that’s not the real problem with email—Gmail’s platform or any other. And that’s the problem no sure
More from Forbes‘Backlash’ – Google’s unbeatable Pixel leaves Samsung behindBy Zak Doffman
Anyone with an email address dating back to 2004 can be sure that it is now listed in countless databases used daily by countless marketers and scammers. But your email address is only in 2014 or even true — and here’s the crux — 2024. As soon as you start using a new address, it’s game over.
“An email address used to be permanent but now it’s finally editable like a username, which is a big change in how identity works online,” says ESET’s Jake Moore. “But until Google creates a ‘Hide My Email’ equivalent to what Apple offers, users may be better off creating a separate email address for multiple sign-ins.”
For those completely unfamiliar with Apple’s ecosystem, Hide My Email enables users to create throw-away addresses for new sign-ins or checkouts. These email addresses can be revoked at any time, meaning that your real address is not stored on those lists, which cannot be resolved once it is done.
“With Hide My Email, you can generate unique, random email addresses that are automatically forwarded to your personal inbox, so you can keep your personal email address private,” explains Apple. “You can change the email address that receives forwarded messages at any time. Or you can turn off email forwarding to stop receiving messages. You can manage the addresses you’ve created through Hide My Email in Settings on your iPhone, iPad or iCloud.com.”
This is what is needed. Embarrassing names aside, there’s little point in changing your email address if you can’t use it as an opportunity to organize your inbox and stop giving out your primary email address to almost anyone who asks. You wouldn’t do that with your phone number — for good reasons.
More from ForbesApple’s update bug – millions of iPhones affectedBy Zak Doffman
Another problem Gmail users face is that with Gmail’s new address change option, “old addresses will still work as aliases,” warns Moore. “This sounds useful but potentially increases impersonation and phishing attacks.”
Google has a Hide My Email option in development, though it’s been around for a while and there’s no sign of general availability. There are games users can play with Gmail addresses to create proxies, but it doesn’t come with any user management on any platform or OS, and therefore fails as a real-world option.
Google has missed a trick. If it had launched an option to change Gmail addresses along with the Hide My Email offer, it would have been an extraordinary move. New addresses can be saved, solving all problems at once. That’s a huge missed opportunity, and so Gmail’s 2 billion users have yet to be exposed.
Meanwhile, if you are planning to change your Gmail address, there are two risks to be aware of. First, you’ll fall victim to a phishing email using US News to trick users into clicking malicious links that seek to lead to new settings. Instead, these links lead to fake sign-in pages designed to steal Google account credentials. These attacks have been seen in other markets where the Gmail rename feature has been released, and they will now hit the US as well.
Second, the Google forum on Reddit is already reporting an increase in spam in inboxes (1,2,3). This could be a coincidence, but researchers warn that this renaming option could be the result of going live – letting attackers refresh.
Per Security Boulevard, “As of March 31st, Google is allowing users to change their primary Gmail address username. Although a nice feature for those who create unfortunate names, it can also weaken spam and phishing blocking.”
More from ForbesMicrosoft’s new Windows update—1 billion users must decide nowBy Zak Doffman
The security website warns that “many email providers use email addresses for end-user blocks and don’t dive any deeper. So, renaming an account is like starting over, and bad email that finds its way through bulk filters can go into the inbox until it’s blocked again.”
In this respect, it is a double hit. Unsolicited emails can still be sent to your old Gmail address if you’ve added a new one, while attackers can change their own addresses to potentially defeat your old protections.
Finally, a word of caution for Apple users reading this article who already benefit from the protections provided by Hide My Email. That anonymity has a limit. While this will protect you from scammers and phishers and spammers, it will no Protect yourself from law enforcement. If requested, Apple may provide a real email address behind a temporary email address. You have been warned.
This article was originally published on Forbes.com
