The problem is, once such an online service is well known, the hackers could just blacklist the host name(s) to the service so no alerting messages are sent. I think this is something that would have to live on the actual Gmail servers so it is not detectable from the client-side.
Re:My Email Canary
by mootothemax on Thursday June 09, 2011 @02:47PM
(#2638282)
The problem is, once such an online service is well known, the hackers could just blacklist the host name(s) to the service so no alerting messages are sent.
Agreed, this is another problem. However, I think that it also depends on who you think might be targeting you. I know that a few years ago, plenty of everyday non-technical folks "hacked" their ex-girlfriend or boyfriends' accounts by doing a password reset with known details.
If the aim is to get notified of similar issues (e.g. my home laptop accessing during office hours), such a service could have merit.
The other catch with the ex-girlfriend/boyfriend is that they are not really after bank details so the Barclay's email won't interest them as it would the professional criminal... The problem with the canary is that it is trying to tailor a trap to someone without knowing much about them.
Which is another reason why the IP-based approach works better.
The IP-based approach seems flawed from my pov as someone who travels often. I'm always checking in from various IP addresses. Even locals who like to log in from the nearest cafe would get false positives, while the canary approach is more targeted.
I can imagine paying for a 'cloud watch' service that keeps an eye on all my online accounts and tells me if something odd is happening.