Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: URL Canary – Get an alert when someone finds your secrets

urlcanary.com

Post reply on HN
Print view View original

21–30 of 122 posts

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#21

Post by jstanley »

sorenjan wrote: post #20
ada1981 wrote: post #2

This is neat. For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.

You can preview bit.ly links by appending a + to it.

But if you are already suspicious enough that you want to do that, you were never going to click on the original URL anyway, so it's no worse than not using bit.ly.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#22

Post by efficax »

Will the canary URLs always be to the same domain? If so, can't I circumvent this just by using custom dns locally to map that domain to somewhere else, like localhost? If it's not a domain, but an IP address, can't I just route that IP somewhere else?

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#24

Post by [deleted] »

diggan wrote: post #7

I don't understand this. Someone just visits the URL and I get a email notification? If it's supposed to be secret, how does the script knows if the visit is OK or not, sending me the notification only when it's OK? Are the good guys supposed to know this is a sort of "honeypot" URL and not visit it?

[deleted]

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#26

Post by jstanley »

efficax wrote: post #22

Will the canary URLs always be to the same domain? If so, can't I circumvent this just by using custom dns locally to map that domain to somewhere else, like localhost? If it's not a domain, but an IP address, can't I just route that IP somewhere else?

There are currently 3 domains available. If this takes off I could do something like mailinator (offer the user a small selection, but never reveal the full list at once).

You can also register your own domain and point it at my server and your canary will work just fine on that domain.

If you're playing at a high enough level that you've specifically blackholed URL Canary traffic by IP address, then you're a worthy adversary. And additionally, that is a splendid problem for my project to have.

On the enterprise tier you even get your own server with its own IP address, so there should be nothing linking it to URL Canary at all. (Although the enterprise tier is extremely expensive, and if anyone buys it I will probably panic).

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#28

Post by mikejarema »

jstanley wrote: post #3
ada1981 wrote: post #2

This is neat. For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.

Great idea! Might even be possible to sort that out for the user automatically...

The bit.ly approach might result in false positives as the namespace for bit.ly links is quite easy to iterate over (assuming you don't use a custom link).

Also, doesn't bit.ly access a URL to pull a title or generate a preview? This would send a click through to the canary as well.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#29

Post by raverbashing »

sorenjan wrote: post #20
ada1981 wrote: post #2

This is neat. For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.

You can preview bit.ly links by appending a + to it.

I usually curl shortened urls, the response is either a 301/302 or an html page with a redirect (usually the latter)
Post reply on HN