My idea is for a popular email provider (e.g. Gmail) to let users create auto-generated disposable email addresses that are aliases for their main account, in order to detect data breaches at companies that users submit their email address to. (Note: I am aware this feature exists on some little-used email providers, but that doesn't solve this problem, for reasons discussed below.)
This way, when you create an account with a company like eBay, you create a disposable email alias to give to that company, and you annotate the alias with a note like "Submitted to eBay on June 29, 2018". Messages to that alias still get forwarded to your inbox. But if you ever receive any spam sent to that address, you know that that company's member database was compromised.
Now, getting spam at that address doesn't absolutely guarantee that the company's member database was compromised -- perhaps someone installed malware on the user's machine that captured their alias as they were generating it. However, if many users simultaneously start getting spam at the alias address they generated for eBay (but not at the alias addresses they generated for other sites), and they all start complaining about it at once on Facebook, then this means eBay was probably compromised.
Now I know there are options out there that look almost-but-not-quite like this, but here's why I don't think they solve this problem:
little-used email providers that let you created disposable aliases for your email address, as I'm describing. This does allow the individual user to find out which service the breach occurred at, and to block any future emails to that address. The problem with these services is that if any of these sites become generally known as a way to detect breaches, and if the attacker wants to delay the breach being detected, they can just avoid sending mail to addresses on that list -- as long as the email domain is not widely used, the attacker won't be giving up much. So, this would help the individual user avoid spam from data breaches, but it wouldn't help them contribute to crowdsourcing the detection of those data breaches. (Besides, if it's an obscure company, who knows if it will be around for long? If they go out of business, you have to switch all your membership email addresses to a new domain.) The only way to avoid this problem is if the email provider is a popular service provider like Gmail, Hotmail, etc.
appending something with a "+" sign like yourrealaddress+customextension@gmail.com to the end of your email address. This doesn't work because the attacker can easily strip out the "+customextension" from all email addresses before spamming them.
So, my questions are:
- Is there any particular reason why this would not work, and would not provide a valuable public service in detecting data breaches?
- Has this idea been discussed or promoted elsewhere? Because I haven't found anything advocating this approach. (Remember, I'm talking specifically about a push for a major email provider to adopt this as a feature, not whether this feature exists on a little-known email service. If a little-used email provider is offering this service, that solves the problem for the user, but it doesn't solve this problem, which is scalable crowdsourcing of breach detection.)