idea to detect data breaches by letting users create single-click single-use email aliases

Question

My idea is for a popular email provider (e.g. Gmail) to let users create auto-generated disposable email addresses that are aliases for their main account, in order to detect data breaches at companies that users submit their email address to. (Note: I am aware this feature exists on some little-used email providers, but that doesn't solve this problem, for reasons discussed below.)

This way, when you create an account with a company like eBay, you create a disposable email alias to give to that company, and you annotate the alias with a note like "Submitted to eBay on June 29, 2018". Messages to that alias still get forwarded to your inbox. But if you ever receive any spam sent to that address, you know that that company's member database was compromised.

Now, getting spam at that address doesn't absolutely guarantee that the company's member database was compromised -- perhaps someone installed malware on the user's machine that captured their alias as they were generating it. However, if many users simultaneously start getting spam at the alias address they generated for eBay (but not at the alias addresses they generated for other sites), and they all start complaining about it at once on Facebook, then this means eBay was probably compromised.

Now I know there are options out there that look almost-but-not-quite like this, but here's why I don't think they solve this problem:

• little-used email providers that let you created disposable aliases for your email address, as I'm describing. This does allow the individual user to find out which service the breach occurred at, and to block any future emails to that address. The problem with these services is that if any of these sites become generally known as a way to detect breaches, and if the attacker wants to delay the breach being detected, they can just avoid sending mail to addresses on that list -- as long as the email domain is not widely used, the attacker won't be giving up much. So, this would help the individual user avoid spam from data breaches, but it wouldn't help them contribute to crowdsourcing the detection of those data breaches. (Besides, if it's an obscure company, who knows if it will be around for long? If they go out of business, you have to switch all your membership email addresses to a new domain.) The only way to avoid this problem is if the email provider is a popular service provider like Gmail, Hotmail, etc.

• appending something with a "+" sign like yourrealaddress+customextension@gmail.com to the end of your email address. This doesn't work because the attacker can easily strip out the "+customextension" from all email addresses before spamming them.

So, my questions are:

1. Is there any particular reason why this would not work, and would not provide a valuable public service in detecting data breaches?
2. Has this idea been discussed or promoted elsewhere? Because I haven't found anything advocating this approach. (Remember, I'm talking specifically about a push for a major email provider to adopt this as a feature, not whether this feature exists on a little-known email service. If a little-used email provider is offering this service, that solves the problem for the user, but it doesn't solve this problem, which is scalable crowdsourcing of breach detection.)

Answer 1

I can see quite a few reasons why large providers wouldn't want to do this, although they aren't all from a security point of view.

Firstly, they already have huge numbers of email addresses that at some point a human selected, and many of those are terrible - they have a long string of random numbers at the end, and are unmemorable even to the owners. Adding the ability for each user to generate further email addresses would further cut into the supply of acceptable email usernames, especially since you want them to be indistinguishable from main addresses (else your objection to adding +company also applies to these).

Secondly, they already provide the filtering ability (the +company) pattern, which works "well enough" for most people. It can easily be bypassed, true, but can also be used for other purposes, so it's essentially a bonus feature (from what I can tell, it was envisioned for companies to be able to send form submissions into folders automatically by setting the submission address to +feedback, +complaints, etc.). Aliases are also already built in, and if you are a paid customer with your own domain, you can use them as much as you like.

That brings up the third point: they effectively offer this for the people who actually pay them for the service already. It could be considered an incentive to subscribe, rather than just using the free service.

There just doesn't seem to be much of a benefit for the email providers in this case. They are businesses, after all, and have spent a lot of effort in terms of detecting spam and hiding it from users. If you're seeing spam, they're failing at filtering, and if users don't see the spam, they aren't going to be talking about it.

If they wanted to detect potential breaches, they probably have the data anyway - look for email addresses which get messages from specific services, cross reference with junk messages, and make a call based on probability. This would probably be more reliable than the crowdsourced approach, since there is more data available.