4 ms·
This makes me wonder if anyone has set up canary emails or phone numbers in their phone contacts.
by rasse 6y ago
This makes me wonder if anyone has set up canary emails or phone numbers in their phone contacts.
- KirillPanov 6y agoThe robocall epidemic has pretty much made the notion of "canary phone numbers" useless.
- praptak 6y agoWhat do you mean by "canary" in this context? How do you detect that the canary is dead? I assume that the "canary being dead" ~= "an adversary added the contact to their watch list". But I don't think you can detect that. The best you could do is to add a random physical address hoping that you can detect physical surveillance (which is probably not realistic anyway).
- rzzzt 6y agoIt is like signing up with an e-mail +suffix for services, or the non-existent streets on digital maps; if you come across your fake contact elsewhere, you know that information has been shared.
- rasse 6y agoExactly!
- vmception 6y agoit is trivial to strip suffixes off of aliased email addresses
- kogir 6y agoIf you control your own email routing, by using your own mail server, Google Workspace, Microsoft 365, etc, you can choose whatever convention you want. How would you know to strip everything after my first name?
- rsync 6y ago"it is trivial to strip suffixes off of aliased email addresses ..." This actually is not a bad point to make ... it would, in fact, be simple to strip +aliases but ... economically I don't think it makes any sense. You'd have to have a high level decision maker dictating an engineering fix in order to increase email authenticity by ... .01% ? ... and that assumes that the "engineers" down the chain understand how '+' works in email to begin with and have somehow communicated that back up to management.
- vmception 6y agoMy response here is that I think this discussion is naive, as the data brokers themselves already do it. So who cares about what some engineer at a random new business thinks. Aliasing isn't new. So this isn't a cat and mouse game that just got started.
- rzzzt 6y agoWhat is the equivalent to that in the fake phone contacts domain? I guess removing people with the +21 country code would work for this particular approach, but otherwise...?
- vmception 6y agoGood question hmm, I think its just a different strategy with phone contacts A data broker primarily wants the social graph to make a user profile with a phone number, to show ads later on. Those people wont typically be texting or calling with spam and ads, theyll just match the number and contacts up with information shared in other apps so that ads in your normal internet browser or ad-include app use are more targeted so if an erroneous contact never logs in thats of no consequence to them, so searching to exclude numbers would be less interesting and less likely than with just sanitizing emails
- rasse 6y agoDetection would require a call/sms/email. The idea would be just to detect, if your leaked data has been acted upon.
- arminiusreturns 6y agoI create a new email for most services I use, (run my own email) but I had'nt thought of this! Thanks for the idea.
- rsync 6y ago"This makes me wonder if anyone has set up canary emails or phone numbers in their phone contacts." We (rsync.net) have a handful of dummy/fake users in our database whose emails we monitor. The email addresses are cryptic and random and use a different domain, etc. We should never see an email sent to one of these "canary" email addresses and, so far, we have not. I am also aware that many of our customers sign up with service-specific email addresses, using the '+' character ... something like john+rsync@mydomain.com. I personally have a rich and well developed pseudonym that I use for all online non-governmental transactions but in some rare cases I need to use my actual name and email - and in those cases I create '+' aliases.
- techsupporter 6y agoI've noticed a bunch of spammers starting to strip out anything after the + and before the @. This is why I've long used a catch-all e-mail domain (subdomain.example.net) where I can put anything I want to the left of the @ sign and no one is the wiser for my real e-mail address.
- Answerawake 6y agoIs there some service where I can easily create unlimited custom email addresses for a flat monthly fee? I want to use a unique email for each new website/service. That would go a long way to solving some data leak/privacy problems. The problem with custom domain is I have to maintain it right? I want a service which I don't have to maintain. I used to use new Yahoo accounts but they are a hassle and recently they disabled free auto-forwarding.