3 ms·
What do you mean by "canary" in this context? How do you detect that the canary is dead? I assume that the "canary being dead" ~= "an adversary added the conta
by praptak 6y ago
What do you mean by "canary" in this context? How do you detect that the canary is dead?
I assume that the "canary being dead" ~= "an adversary added the contact to their watch list". But I don't think you can detect that.
The best you could do is to add a random physical address hoping that you can detect physical surveillance (which is probably not realistic anyway).
- rzzzt 6y agoIt is like signing up with an e-mail +suffix for services, or the non-existent streets on digital maps; if you come across your fake contact elsewhere, you know that information has been shared.
- rasse 6y agoExactly!
- vmception 6y agoit is trivial to strip suffixes off of aliased email addresses
- kogir 6y agoIf you control your own email routing, by using your own mail server, Google Workspace, Microsoft 365, etc, you can choose whatever convention you want. How would you know to strip everything after my first name?
- rsync 6y ago"it is trivial to strip suffixes off of aliased email addresses ..." This actually is not a bad point to make ... it would, in fact, be simple to strip +aliases but ... economically I don't think it makes any sense. You'd have to have a high level decision maker dictating an engineering fix in order to increase email authenticity by ... .01% ? ... and that assumes that the "engineers" down the chain understand how '+' works in email to begin with and have somehow communicated that back up to management.
- vmception 6y agoMy response here is that I think this discussion is naive, as the data brokers themselves already do it. So who cares about what some engineer at a random new business thinks. Aliasing isn't new. So this isn't a cat and mouse game that just got started.
- rzzzt 6y agoWhat is the equivalent to that in the fake phone contacts domain? I guess removing people with the +21 country code would work for this particular approach, but otherwise...?
- vmception 6y agoGood question hmm, I think its just a different strategy with phone contacts A data broker primarily wants the social graph to make a user profile with a phone number, to show ads later on. Those people wont typically be texting or calling with spam and ads, theyll just match the number and contacts up with information shared in other apps so that ads in your normal internet browser or ad-include app use are more targeted so if an erroneous contact never logs in thats of no consequence to them, so searching to exclude numbers would be less interesting and less likely than with just sanitizing emails
- rasse 6y agoDetection would require a call/sms/email. The idea would be just to detect, if your leaked data has been acted upon.