Live data from Hacker News

Show HN: URL Canary – Get an alert when someone finds your secrets

urlcanary.com

81–90 of 122 posts

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#81
post #17

A quick test using Zapier's webhook functionality tells me I can duplicate this with their platform. Doesn't seem to work with link shortener, but I have the sense more time invested on that will yield a result. So, I think the concept has merit but you're off center of the target and much more value is required.

I imagine there's a lot of value to be found in a dashboard, or generally in managing these canaries. Which canary was deployed where, how often are they triggered (with the ability to mark some instances as false alarm) etc.

But of course that heavily depends on the use case

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#84
post #19

You might think about embedding bounties in crypto blockchains. For example, create BTC wallets that can be unlocked using a secret sitting next to (or steganographically embedded in) the secret you're trying to protect. This gives the person uncovering the secret an incentive to activate the canary. {RI,MP}AA are apparently doing this with their music and movies, so they know when they are showing up on pirate sites…

The MirageOS project has done this, they call it the "Bitcoin Piñata".

It's still unclaimed I believe: http://ownme.ipredator.se

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#85

Earlier quoted context omitted.

Given this kind of disaster potential, wouldn't it be a rather attractive option to use /dev/urandom?

Bytes::Random::Secure::Tiny seeds itself from /dev/urandom, I just need to make sure to initialise it on first use, instead of when my program first starts (which I've now done). In general I suspect if anything you'd be more likely to mess it up by reading bytes from /dev/urandom manually than by using a library.

How exactly can one mess up reading bytes from `/dev/urandom`? Serious question.

Open the file. Read from it. If no failures on open or read, you have random bytes. In essence, there is already a library for this: `open` and `read`, which seems to be the same API surface area as this library.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#86
post #76

Earlier quoted context omitted.

You can use any domain you like, although I don't think I've documented that. Just point any domain at 46.101.33.42 and it'll work. (But obviously it needs to be a hostname you're not already using for something else).

Sorry to offer unsolicited advice, but are you sure you wanna use a fixed IP for that? Seems more reasonable to ask people to CNAME to a domain you guarantee will always point to the correct servers. This means you don't break the system when you move IP address. Moreover, should you ever need to, you can round-robin the domain for either reliability or load-balancing (though I doubt that would be necessary).

If you are serious about testing this, someone will just DDOS the ip and the monitoring is offline for everyone.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#87
post #84
post #19

You might think about embedding bounties in crypto blockchains. For example, create BTC wallets that can be unlocked using a secret sitting next to (or steganographically embedded in) the secret you're trying to protect. This gives the person uncovering the secret an incentive to activate the canary. {RI,MP}AA are apparently doing this with their music and movies, so they know when they are showing up on pirate sites…

The MirageOS project has done this, they call it the "Bitcoin Piñata". It's still unclaimed I believe: http://ownme.ipredator.se

Claimed today I believe. Possibly inspired by your post

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#88
post #87
post #84

Earlier quoted context omitted.

The MirageOS project has done this, they call it the "Bitcoin Piñata". It's still unclaimed I believe: http://ownme.ipredator.se

Claimed today I believe. Possibly inspired by your post

From their site:

"This challenge started in February 2015, and will run until the above address no longer contains the 10 bitcoins it started with, or until we lose interest. In 2018 we will likely reuse most bitcoins for other projects."

So I'm not sure what happened frankly.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#89
post #87
post #84

Earlier quoted context omitted.

The MirageOS project has done this, they call it the "Bitcoin Piñata". It's still unclaimed I believe: http://ownme.ipredator.se

Claimed today I believe. Possibly inspired by your post

Is there a source that it was definitely claimed? The BTC have moved, but the site notes "[i]n 2018 we will likely reuse most bitcoins for other projects", and the transaction (splitting into two amounts of 9BTC and ~1BTC) aligns with this Tweet from December:

> PSA: the bitcoin piñata will be reduced by a large amount, the owner who lend the 10 btc wants to spent 9 on useful projects

https://twitter.com/h4nnes/status/939430639576715264

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#90

Similar idea than https://uriteller.io . This is nice way to check whether your end to end encrypted chat is really secure or not.

This is brilliant. They recommend using a url shortener, but I want to see if anyone is parsing comments and visiting urls from HN.

https://uriteller.io/7S6asCJSwrOzApjG84hIRA

Edited to add:

Here's the view key if you're interested. Just append it to the end of uriteller.io:

ZBt0gGoUHtIsyQ7KFwikYg

A crawler on AWS hit it two minutes after I posted it.

Post reply on HN