Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: URL Canary – Get an alert when someone finds your secrets

urlcanary.com

Post reply on HN
Print view View original

41–50 of 122 posts

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#41

Post by dsacco »

jstanley wrote: post #9
diggan wrote: post #7

I don't understand this. Someone just visits the URL and I get a email notification? If it's supposed to be secret, how does the script knows if the visit is OK or not, sending me the notification only when it's OK? Are the good guys supposed to know this is a sort of "honeypot" URL and not visit it?

You won't share the URL in a public place, you'll store it alongside whatever you're trying to keep safe. If the URL gets accessed at all, you will know your secret has been leaked.

Friendly feedback, coming from a reverse engineer: the commenter who also answered this question gave a really good, concrete example of how this could be used in the context of DRM. When I visited your page I was initially perplexed as to why you’d want any of this. You should include a specific example of how this service delivers value, and the reverse engineering example is a good one.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#42

Post by jstanley »

dsacco wrote: post #41
jstanley wrote: post #9

Earlier quoted context omitted.

You won't share the URL in a public place, you'll store it alongside whatever you're trying to keep safe. If the URL gets accessed at all, you will know your secret has been leaked.

Friendly feedback, coming from a reverse engineer: the commenter who also answered this question gave a really good, concrete example of how this could be used in the context of DRM. When I visited your page I was initially perplexed as to why you’d want any of this. You should include a specific example of how this service delivers value, and the reverse engineering example is a good one.

Thanks for the feedback :)

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#43

Post by ada1981 »

ada1981 wrote: post #2

This is neat. For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.

If you can use any domain you like, that is great.

MyURL.com/101/passwords /private /logins

Is the idea that you'd embed this in a way that it is automatically triggered? Or that you would leave it in plaintext somewhere and assume someone would eventually visit it if they were snooping around your stuff?

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#44

Post by jstanley »

ada1981 wrote: post #43
ada1981 wrote: post #2

This is neat. For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.

If you can use any domain you like, that is great. MyURL.com/101/passwords /private /logins Is the idea that you'd embed this in a way that it is automatically triggered? Or that you would leave it in plaintext somewhere and assume someone would eventually visit it if they were snooping around your stuff?

You can use any domain you like, although I don't think I've documented that. Just point any domain at 46.101.33.42 and it'll work.

(But obviously it needs to be a hostname you're not already using for something else).

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#45

Post by foepys »

CamTin wrote: post #19

You might think about embedding bounties in crypto blockchains. For example, create BTC wallets that can be unlocked using a secret sitting next to (or steganographically embedded in) the secret you're trying to protect. This gives the person uncovering the secret an incentive to activate the canary. {RI,MP}AA are apparently doing this with their music and movies, so they know when they are showing up on pirate sites…

As skeptical as I am about crypto currencies, this is a really interesting application. Basically exploiting human greed. Thank you for sharing it.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#46

Post by hardly_a_mirage »

CamTin wrote: post #19

You might think about embedding bounties in crypto blockchains. For example, create BTC wallets that can be unlocked using a secret sitting next to (or steganographically embedded in) the secret you're trying to protect. This gives the person uncovering the secret an incentive to activate the canary. {RI,MP}AA are apparently doing this with their music and movies, so they know when they are showing up on pirate sites…

I'm interested in understanding how the RIA/MPAA canary works. Can you please elaborate or provide an explanatory link?

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#48

Post by bmm6o »

jstanley wrote: post #14
dylanpyle wrote: post #12

FYI - I signed up and the email confirmation page showed me someone else's canary URL

That's not good! Taking a look. EDIT: I believe it's because the CSPRNG state ( https://metacpan.org/pod/Bytes::Random::Secure::Tiny ) was created before the process forks, so they shared the initial state and generated the same token. I've reduced it to 1 worker pending an actual fix. Sorry about that, and thanks for pointing it out.

There was a recent discussion about (not) sharing CSPRNG state with fork-ed processes: https://news.ycombinator.com/item?id=15759855

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#49

Post by gricardo99 »

diggan wrote: post #7

I don't understand this. Someone just visits the URL and I get a email notification? If it's supposed to be secret, how does the script knows if the visit is OK or not, sending me the notification only when it's OK? Are the good guys supposed to know this is a sort of "honeypot" URL and not visit it?

You could also put it in something like your 1Password Vault. Although, if that's been hacked/accessed, you may not have time to save yourself.
Post reply on HN