This makes me wonder if anyone has set up canary emails or phone numbers in their phone contacts.
We (rsync.net) have a handful of dummy/fake users in our database whose emails we monitor. The email addresses are cryptic and random and use a different domain, etc.
We should never see an email sent to one of these "canary" email addresses and, so far, we have not.
I am also aware that many of our customers sign up with service-specific email addresses, using the '+' character ... something like john+rsync@mydomain.com.
I personally have a rich and well developed pseudonym that I use for all online non-governmental transactions but in some rare cases I need to use my actual name and email - and in those cases I create '+' aliases.
I have been using this since 2002. You don't even have to set anything up - just make up addresses on the fly. It's pretty awesome.
I personally use the website as the email (example, if HN required an email it would be hn@mydomain.com) to make it easier to filter. But this can be gamed/guessed, to be more secure it is better to generate an actual random email for each site and store it in your password manager.
I also remember seeing one Show HN recently that offered similar functionality, but couldn't find it via search. The problem is that if the e-mail alias provider becomes popular enough, their subdomains are soon disqualified from being used when registering to sites.
I assume that the "canary being dead" ~= "an adversary added the contact to their watch list". But I don't think you can detect that.
The best you could do is to add a random physical address hoping that you can detect physical surveillance (which is probably not realistic anyway).
How would you know to strip everything after my first name?
I would just strip everything after a + sign
This actually is not a bad point to make ... it would, in fact, be simple to strip +aliases but ... economically I don't think it makes any sense.
You'd have to have a high level decision maker dictating an engineering fix in order to increase email authenticity by ... .01% ?
... and that assumes that the "engineers" down the chain understand how '+' works in email to begin with and have somehow communicated that back up to management.
So who cares about what some engineer at a random new business thinks.
Aliasing isn't new. So this isn't a cat and mouse game that just got started.
A data broker primarily wants the social graph to make a user profile with a phone number, to show ads later on. Those people wont typically be texting or calling with spam and ads, theyll just match the number and contacts up with information shared in other apps so that ads in your normal internet browser or ad-include app use are more targeted
so if an erroneous contact never logs in thats of no consequence to them, so searching to exclude numbers would be less interesting and less likely than with just sanitizing emails