Show HN: Breach Insider – Detect a data breach using realistic pseudo-users

Post by noja » Mon, Dec 04, 2017, 6:34 PM UTC

macNchz wrote: post #28

mikejarema wrote: post #16

Earlier quoted context omitted.

A quick Google didn't yield much for "canary passwords", but it sounds like monitoring for passwords as opposed to user email/details as described in the OP. Care to shed a bit more light on what you mean here and how to effectively use them?

I think he’s referring to the idea of having fake users in your database whose passwords should never be used to sign in. Someone successfully signing in with one of those accounts indicates that your user account credentials have been compromised.

Post by gesman » Wed, Dec 06, 2017, 10:03 PM UTC

rayuela wrote: post #40

gesman wrote: post #17

Earlier quoted context omitted.

I did similar project with Tensorflow. Mouse movements were captured then converted to images and DL model was trained to classify user or not user. It can also classify classes of users I.e. new portal users are moving mouse differently from users who are familiar with portal. To add - by itself it’s not a reliable indicator of yes/no. But rather another risk scoring input to overall identity detection system.

This is actually clever. Thanks for sharing the technique!

Post by jakub_g » Thu, Dec 07, 2017, 8:04 PM UTC

snowwolf wrote: post #11

Somewhat related, but anyone have any best practices or can recommend a service to protect your users who have been pwned in another sites data breach? Rate limiting login attempts for an email address or ip address is all well and good for protecting against brute force attacks, but when the attacker has the correct email and password combination already for the user, and access to massively distributed botnets, how…