Bad data makes it less valuable for resale. It's an attack on the market that these things operate under.

Can also be used as a canary trap.

> Can also be used as a canary trap.

Can you please explain how this can operate as a canary?

Edit: another post explains that the method is if the bogus data end up an a data leak, but that would require keeping track of bogus submissions and generating new data for each company where you create an account. Then you’d have to cross reference like crazy. Am I missing something simpler?

I know at least one person who has their own personal family domain set up so that his family members can just create new email addresses specific to the vendor when shopping online (for example, '[email protected]' and '[email protected]' ). Then all their shopping emails just get routed to his domain. Being able to track which company leaked or sold an email address seems like another benefit in addition to catching all the marketing emails.

Gmail has this feature baked in. Append a + sign to the username and then append any string you want, ie. [email protected]. It will forward these mails to your regular email address. I started doing this for the exact same reason as mentioned above, but you can obviously do more than just creating honeypots. Also you have to ignore the fact that it's Google...

There already exists at least one popular js validation framework which removes Gmail (and others) subaddresses per default in its "normalizeEmail" method: https://github.com/validatorjs/validator.js/blob/master/src/...

I do this. A small annoyance can crop up when trying to log in to a service with your + modified email address. Hmmm, what did I append after the plus? If you can't remember that, you can't use the "forgot my password" function either :)

Usually soluble, but irritating.

This is basically a mechanism that would allow for a honeytrap on steroids. https://blog.finjan.com/honeytokens-used-to-track-cybercrimi...

> that would require keeping track of bogus submissions

You don't have to keep track of the submissions because you can generate them with a reversible algorithm. Basically use a word list method https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... but have the list be entirely people's names (or generated from a corpus of known accounts and something like https://github.com/minimaxir/textgenrnn to make them harder to spot)

> generating new data for each company where you create an account.

yes https://arxiv.org/abs/2006.15794

Basically treating the data from various email honeypots as a "Numbers station" but instead of using it to prime encryption keys, you use it as a form of steganography. To do this entirely anonymously, the next step would be to publish on a public blockchain or anonymous service so that the owner's device (that generated the emails originally) can uploaded a signed statement that proves they were the phone pwned and who the offending app was.

A similar idea seems baked into a couple of crypto initiatives https://coincentral.com/sentinel-protocol/ but fundamentally we're talking about an anonymous reputation system modeled after how swarms operate to gossip risk.

It would be necessarily stochastic in nature because you'd be depending on the 3rd parties to send emails a bit at a time, but if you get a deluge of phones all reporting the same app, you can assume fairly confidently that app has been compromised. Punishment (Brand reputation, sanctions by app store) for being compromised would encourage better security.

This could (and would need to be) operated at the hardware level and orchestrated by the OS, and OS provider. This is the kind of thing apple and google could do as part of their privacy initiatives around "differential privacy" https://venturebeat.com/2019/12/21/ai-has-a-privacy-problem-...

What, you think that deep learning chip on your phone is there to make cute avatars?

Well since it uses names (last and first) that all start with Z most of these crooked outfits could survive losing 0.5% of the "real" names off their list by filtering the Z. Z. names.

Not an expert on guerilla cyber-warfare, but isn't it the whole point of this sort of poisoning? If enough people do this the cost of those bouncing emails would become prohibitive. That's my speculation. Would be great to know more from someone who knows the domain better.

Oh! I know! I work for a large company. At one point, we sent so much junk mail, we were the Post Office's #1 customer (in the US). We have started to send junk emails, too.

There is a Swedish company (non profit? Activist group? IDK) called SpamHause. They partner with ISPs to help block spam. Their process is something along the lines of:

1) Inject fake email addresses into lists of email addresses that are bought/sold WITHOUT user consent

2) Wait until someone UNAUTHORIZED emails them spam

3) Tell the ISPs (and anyone else who will listen) to STOP processing emails from the companies that sent them spam.

4) The ISPs block the companies because SpamHause is reputable and REALLY good at finding spam, also the ISPs save money by "not having to process the spam

We accidentally got a hold of a bad batch of email addresses several years ago and we spent MONTHS trying to fishout and overhaul our email authorization process. It cost us $10s of millions.

Also, WHY were we sending that spam?!?

Even if you make your contact list 99% bounces and 1% real (and every user of the app does the same), I don't see how this becomes a problem for the app's operator. Remove a contact after 1-2 bounces and you're golden.

Fair. Still golden if this needs to be done for all contacts of all users?

If they bounce they are extremely fast to cull.

Who bounces any more?

Everyone except nutters. Google bounces. Microsoft too. I don't know of any provider that doesn't. Surely someone somewhere does not bounce but they are in the minority.

You don't bounce emails you prebounce them and clean up your list. This is part of any sensible data engineers process.

More helpfully, salting their db with real emails but fake contact info requires a more durable hygiene process and often isn't worth the effort for data driven shops.

You serve a variety of email domains that validate as deliverable, then you accept emails and report the sender, which hurts their deliverability.

what is prebounce?

My guess was they are referring to one of these services that check the validity of any email address. A false signal from one of these services prevented me from signing up for some random website with a .name domain the other day.

Email them from a throwaway domain and ip, toss out hard bounces from the list, so you don't poison your SMTP reputation?

Pretty nifty side point:

> If enough people do this the cost of those bouncing emails would become prohibitive.

This idea got a ton of attention in early days tech that led to what's known as proof of work: see bitcoin. The primitives of btc show up in a lot of interesting areas.

It will be interesting to see if these fake contacts show up in a leak somewhere someday. Almost like how people do [email protected], we could create similarly fake contacts to see who is selling or leaking data.

*@myname.name

Yeah I've been using [email protected] for ages to track who's sold or fumbled my data. Since haveibeenpwned I can even approximately separate the two groups. Surprisingly up to now nearly all incidents (that I know of) have been breaches. Not that it makes it any better.

Same here. Though people usually give me weird looks when I do this IRL and ask me "Is your email address really [email protected]"?

I had these weird looks, and I even got engaged in a nice conversation with an employee at a t-mobile store, but some people don't even bat an eye.

I'm surprised it has such a harsh name. Years ago I was wondering what would happen if people just came up with random data, e.g. derived from the own personal data, thinking about crawlers, automatized personal data processing. But I'd just call it creating garbage data because that's what it is. Eventually it will be impossible for an algorithm to distinguish between real and garbage data. (And probably not only for an algorithm)

But I agree with you, it's probably the wrong approach. Personally I've deleted quite a lot of accounts/uninstalled bloated apps. In addition I use tools that actually set additional boundaries, but I'd prefer if the apps wouldn't be so data hungry in the first place.

I think the trick is that different users might create "identical garbage" so that contacts match on the backend.

Hm ok, that's a nice trick though

The vast majority of phone calls I receive are spam calls by people/robocallers which I did not give my phone number to, but apparently someone else did. I don't want people sharing my phone number with random other people

Nobody had to give them your phone number.

They just dial numbers at random. Phone numbers aren't sparsely distributed. There are entire area codes that are essentially fully utilized.

I thought that the new challenge-response systems between providers (shaken-stir?) was supposed to take 99.9% of this. I guess I'm off to see if they have actually fully implemented it between providers.

Edit: looks like summer is the mandated time. From: wikipedia article on Stir/Shaken As of 2019, SHAKEN/STIR is a major ongoing effort in the United States, which is suffering an "epidemic" of robocalls.[1] Both the Canadian Radio-television and Telecommunications Commission and the Federal Communications Commission are requiring use of the protocols by June 30, 2021.[2][3]

In addition to that, you probably don't get into contact with fake contacts very often... it is just a smoke mirror to make the users think that they have privacy...

Better to use canary email addresses that actually go somewhere you can detect incoming emails. Then it would be useful.