Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: URL Canary – Get an alert when someone finds your secrets

urlcanary.com

Post reply on HN
Print view View original

11–20 of 122 posts

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#11

Post by jstanley »

rplnt wrote: post #8
jstanley wrote: post #5

Earlier quoted context omitted.

It can be useful anywhere you have sensitive information that you wouldn't want to fall into the wrong hands, or more specifically that you would want to find out if it did. It could go in backups, in your git repository, bug tracker, internal wiki, etc. For an average non-techy, I don't know... they might want to put one in their diary?

For any web/cloud service, I think this might be easily triggered when the service is trying to be helpful. I.e. when fetching previews, displaying in/active links, etc...

You're right, and this does happen.

If that's a problem for you then you can mitigate it a bit by checking the User-Agent and IP address in the alert email you receive.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#14

Post by jstanley »

dylanpyle wrote: post #12

FYI - I signed up and the email confirmation page showed me someone else's canary URL

That's not good! Taking a look.

EDIT: I believe it's because the CSPRNG state ( https://metacpan.org/pod/Bytes::Random::Secure::Tiny ) was created before the process forks, so they shared the initial state and generated the same token. I've reduced it to 1 worker pending an actual fix.

Sorry about that, and thanks for pointing it out.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#16

Post by mikey_p »

ada1981 wrote: post #2

This is neat. For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.

That doesn't fully obscure the original URL though, it's very easy to issue a HEAD request and examine the headers first.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#17

Post by rrggrr »

A quick test using Zapier's webhook functionality tells me I can duplicate this with their platform. Doesn't seem to work with link shortener, but I have the sense more time invested on that will yield a result. So, I think the concept has merit but you're off center of the target and much more value is required.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#19

Post by CamTin »

You might think about embedding bounties in crypto blockchains. For example, create BTC wallets that can be unlocked using a secret sitting next to (or steganographically embedded in) the secret you're trying to protect. This gives the person uncovering the secret an incentive to activate the canary. {RI,MP}AA are apparently doing this with their music and movies, so they know when they are showing up on pirate sites.
Post reply on HN