Why Cyberinity matches breach data on your device
Monitoring services ask you to hand over the very identifiers you're worried about. We spent a month proving we could do the match locally instead — here's the shape of it.
The default architecture for breach monitoring is simple: you upload your email addresses, phone numbers and card details; the service watches its corpus; it emails you when something matches. It works, and it means a single company now holds a tidy, high-value list of exactly what to steal.
We didn't want to be that company, so the constraint came first: the server should never learn which identifiers a user monitors.
The approach we've landed on distributes signed, bucketed indexes to the device. The app derives a short prefix from each identifier, fetches only the buckets that prefix could fall into, and does the final comparison locally. The server sees a request for a bucket that thousands of other users also request, and nothing else.
It costs us things. Bandwidth, for one — buckets are bigger than an answer. Latency on first sync. And some checks we would like to offer are simply harder this way, so they wait rather than get done the easy way.
In exchange, the sentence we most want to be able to write stays true: a breach of us would reveal nothing about you. We'd rather build the product around that sentence than add it to a privacy page later.