Is it bad if one uses the same email address on different sites/forums?

Question

Is it bad practice if one uses the same email address on different sites and forums?

Answer 1

If you are concerned that some site is going to spam you or (worse yet) sell your email address, then you will want to use a unique address for that site.

If you're worried about a site being hacked, well, your email address is mostly public anyway; a hack just makes it a little bit more public.

What you must not do is use the same password across sites. If one of them is hacked, your security on all of them is toast if they all have the same password. It is critically important that the password to your email account be strong and different from any other site. If the bad guys get your email password, they can use the password reset mechanism to break into your other sites. Like your banking site, for example.

There are things a site or forum can do to make it difficult for attackers to compromise the password data, and to help secure the data even if it is compromised. You generally cannot tell who's using best practices and who is not. It is safest to assume that if a site is compromised, your password on that site is toast, along with any others where you've used the same password.

Edited to add: If you care about the ways a site can help protect your password, I wrote a short piece on that a couple of years ago: http://bitmonger.blogspot.com/2012/07/six-simple-rules-for-secure-storage-of.html

Answer 2

Social networking sites often allow users to find friends via email address search.

This may be a privacy concern for some users as another user can verify whether they have an account on a particular site. It is often an option to disable this functionality:

Privacy options screen from Facebook.

Allowing this lookup from anyone can lead to a username enumeration vulnerability, but often this is not a concern for sites such as these as the lookup of users is part of the design and they often bank on people wanting to use the site for its intended purpose (i.e. social networking) and turning off being found by email address could be contrary to this.

Often email address is used as a username, and therefore does not have to be secret or hard to guess. So unlike a password, there is no inherent risk in using the same email for different accounts. Some users tend to use the same email address, but with modifiers such as + symbols or with different local parts on a catchall domain account but this would be trivial for the address to be processed to remove the part following the + symbol. Detecting catch all address domains would be more difficult though but as email validation providers exist, this would not be that difficult.

There are also scenarios such as this where tying the account together by email has led to other accounts being taken over as they were "were daisy-chained together". i.e. The Gmail address was also used as a recovery address on the iCloud account. This would most probably have been prevented though if 2 factor authentication was in use or if the data management policies were more stringent rather than a flaw in sharing the email address between the two services. Going the other way and having multiple email addresses to recover other email addresses leads to more complexity and the risk of locking yourself out of other accounts would be much greater.

So to summarise, using the same email address is not bad practise in itself, however if the registration details are visible by the public or shared between different organisations where you have accounts, it can be determined that you are likely the same person. Likely not definite, as some services do not validate that the email address entered can be received by the user on sign up.