Aller au contenu principal
Life Security

Rechercher sur le site

Rechercher des pages et des sections.

Account creation

Dernière mise à jour:

Creating an account looks like a small decision: an email address, a password, a tick in a box. It’s also the moment you give a company a record about you and a login that other people can try to break into. Most account problems begin at sign-up, and most are cheaper to prevent there than to fix later.

This page explains what you hand over when you sign up, how the main ways of creating an account compare, and how to decide between them. It covers creating accounts. Choosing passwords, setting up two-factor authentication and deleting accounts are separate topics.

What an account is, in plain terms

An account is two things: a login that proves you’re you, and a record the service keeps about you. The login can be stolen. The record can be leaked, sold or used for something you never agreed to.

Take a loyalty app for a coffee chain. To get a discount you give an email address and a phone number, and the app may also keep your purchase history. If the chain is breached, those details leave with everything else, tied to the same email address you use for your bank.

What can go wrong when you sign up

Breaches are the most common problem. The FBI’s Internet Crime Complaint Center (IC3) received 67,456 personal data breach complaints in 2025, the fourth most common type by volume. That’s US data and only counts complaints that people filed. A leaked email address then becomes a target list. Privacy Guides notes that after a hack you may start getting phishing and spam at the address you used.

A breach in one service can also open others. Google’s account hijacking study found that most attempts came from automated bots using passwords exposed in other breaches. A weak or reused password at one small site is a risk for your other accounts. Common threats covers this in more detail.

The service itself can misuse what you give it. The US Federal Trade Commission (FTC) alleged that from 2013 to 2019 Twitter asked people for phone numbers and email addresses with claims such as “Safeguard your account”, then let advertisers use them to target ads. More than 140 million users were affected, according to the FTC. Twitter paid $150 million in 2022 to settle, and was ordered to offer two-factor options that don’t need a phone number. Twitter said the use was inadvertent and that it never shared the details with advertisers directly.

Rules and automation matter too. Large services enforce their terms of service with automated systems that sometimes make mistakes. Privacy Guides notes that people have been locked out for using a VPN or an internet-based phone number, and that appeals are often automated as well. Some services are hard to leave, and a few keep a full history of changes to your account.

The European Union’s General Data Protection Regulation (GDPR) offers a useful standard for sign-up forms, even if you don’t live in the EU. Article 5 says personal data should be adequate, relevant and limited to what’s necessary for the purpose. If a form asks for more than the service needs to work, treat that as information about the service.

The main ways to create an account

Method What you share Main risk Often a good fit for
Email and password An email address, or an alias Password reuse and breaches Most accounts
“Sign in with” a big provider Name and email, and the provider learns you use the service One locked or hacked account affects many Low-stakes services you trust
Phone number A number that identifies you across services Tracking, SIM swaps, marketing Services that truly need it
Username and password only Little or nothing identifying No way to recover the account Accounts where anonymity matters
Passkey A public key, no secret Recovery if you lose your device Services that support it

Email and password

This is still the default. The main rule is a different password for each account, which most people manage with a password manager.

You can also give each service a different email address. An email alias is an address that forwards to your real inbox. Privacy Guides lists three benefits: it helps prevent tracking across services by email address, it lets you filter marketing by alias, and if a service is hacked, a unique alias shows which one. Apple’s Hide My Email works this way. Each service gets a random address, Apple forwards the mail, and the sender never sees your real address. You can switch an alias off if it starts attracting spam.

The cost is trust and recovery. Mail passes through the alias provider’s servers, and if the provider ever closes your account, so do the aliases. Keep your real address for accounts you can’t afford to lose, such as your bank and your main email.

“Sign in with” buttons

“Sign in with Google”, Apple, Facebook and similar buttons use a protocol called Open Authorization (OAuth). You prove who you are to the big provider, and the new service receives a confirmation. Your password isn’t shared. The service usually gets basic details such as your name and email, which you can review during sign-up.

The advantages are real. You rely on a large provider’s security instead of a small service’s, and you manage fewer passwords. The costs are also real. The provider learns which services you use. If that main account is hacked or locked, everything linked to it is affected. Some sign-ins also ask for more access than a login needs, such as your contacts or the ability to post for you, so read the permissions list. Privacy Guides suggests treating these buttons as a convenience for services you trust, and protecting the main account with two-factor authentication.

Phone number

Services ask for a number to verify you, to help you recover the account or to market to you. A number identifies you across services in a way a password doesn’t, and it’s hard to change. The Twitter case above shows what can happen to a number given for security.

If a phone number guards an account, a SIM swap can reach it. Common threats explains how. Don’t try to get around the request with a fake number or an internet-based one for important accounts. Privacy Guides warns that this can trigger fraud checks or leave you locked out, since services use your number for verification. If a service offers an authentication app or security key instead, take it.

Username and password only

A few services let you register without any email or phone number. Privacy Guides says these can offer more anonymity, but there will most likely be no way to recover the account if you forget the password. That makes them a poor fit for anything you’d be sorry to lose.

Passkeys

A passkey replaces the password with a pair of cryptographic keys. The FIDO Alliance, the industry group that wrote the standard, explains that your device keeps the private key and registers the public key with the service, and each passkey is unique to one service. Because there are no shared secrets, passkeys are designed to resist phishing and password reuse. You approve sign-in with a fingerprint, face scan, device PIN or security key.

A service that stores only your public key has nothing that lets an attacker log in as you if it’s breached. The trade-off is recovery. If you lose the device, you need another way back in, such as passkeys synced through your phone or computer’s account or a second security key. In a 2024 survey commissioned by the FIDO Alliance, 53% of people said they had turned passkeys on for at least one account. Expect to meet services that still require a password.

Reading the terms and privacy policy

You don’t need to read every word, and almost nobody does. Skim for four things: what the service collects, whether it shares data with advertisers or other third parties, how long it keeps data, and how you can delete your account.

The privacy policy describes what the company says it will do. Privacy Guides notes that how far a company is legally bound by it depends on your jurisdiction. The Twitter case shows why it still matters: the FTC’s complaint centred on the gap between the reason Twitter gave for collecting numbers and what it did with them.

How to decide before you sign up

These steps run from most useful to least.

  1. Ask whether you need an account at all. If a site offers guest checkout and you won’t come back, use it.
  2. Give the least the form works with. Leave optional fields blank. If a service insists on a phone number for no clear reason, treat that as a warning.
  3. Use a login that can’t be reused. A passkey is best if offered. Otherwise use a unique password.
  4. Choose which email to use. Use an alias for accounts you can afford to lose and your real address for the ones you can’t.
  5. Set up recovery and alerts. Have I Been Pwned lets you check an email address against known breaches and sign up for alerts. A hit doesn’t mean you were hacked, but it’s a reason to change that account’s password.

How much of this to do depends on what the account protects, which is what threat modeling helps you decide. A recipe site needs less care than anything touching money, health or identity.

Sources

Foire aux questions