Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: URL Canary – Get an alert when someone finds your secrets

urlcanary.com

Post reply on HN
Print view View original

91–100 of 122 posts

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#91

Post by stordoff »

dsacco wrote: post #40
droopybuns wrote: post #36

Earlier quoted context omitted.

Put a URL in a firmware image that is never called by your device/app. Monitor the URL for access. You then receive an alert that someone accessed the URL. This gives you a real-time notification that a reverse engineer has looked at your firmware. It also gives you an IP address. So you now “know” that someone might try to hack your device. And you also have an IP address. This is a billion dollar security play! Jok…

Huh. That’s...a good idea. The idea has to be developed further though. This has to be deployed on different domain names and with full content control on the web pages. I guess that’s all doable with the “private server with root access” under enterprise pricing. What a great way to precisely measure cover time. You could inject arbitrary URLs into an application to see if your API has been reverse engineered.

I presume the idea is to make the URL appear to be part of the standard API (and maybe even does something useful to induce use?), but it is never actually called by a legitimate application?

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#92

Post by duck »

makarhum wrote: post #37

Similar idea than https://uriteller.io . This is nice way to check whether your end to end encrypted chat is really secure or not.

I created a similar idea a while back when Gmail started caching images. The main advantage is the image itself contains the log: http://cache-logger.herokuapp.com/hello-world

Code can be found here: https://github.com/kale/image-cache-logger

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#93

Post by moltar »

jstanley wrote: post #14
dylanpyle wrote: post #12

FYI - I signed up and the email confirmation page showed me someone else's canary URL

That's not good! Taking a look. EDIT: I believe it's because the CSPRNG state ( https://metacpan.org/pod/Bytes::Random::Secure::Tiny ) was created before the process forks, so they shared the initial state and generated the same token. I've reduced it to 1 worker pending an actual fix. Sorry about that, and thanks for pointing it out.

+1 for using Perl

Care to share your stack?

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#94

Post by pinum »

jstanley wrote: post #14
dylanpyle wrote: post #12

FYI - I signed up and the email confirmation page showed me someone else's canary URL

That's not good! Taking a look. EDIT: I believe it's because the CSPRNG state ( https://metacpan.org/pod/Bytes::Random::Secure::Tiny ) was created before the process forks, so they shared the initial state and generated the same token. I've reduced it to 1 worker pending an actual fix. Sorry about that, and thanks for pointing it out.

This implies that you should probably invalidate all URLs created before you applied that mitigation, right? Or do you have some way (logs?) of knowing which ones were compromised?

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#95

Post by pinum »

pwinnski wrote: post #59
sli wrote: post #56

So what happens when the three offered domains become widely known to be fake? Can this service be federated and use custom domains or is it just another game of whack-a-mole?

From the landing page: "...and it's easy to setup a URL Canary on a custom domain name."

Not to be overly negative, but if you're going to the trouble of pointing a custom domain to this service, couldn't you just write a quick PHP script that mail()s out when it's accessed? As far as I can see, the only advantage of using this third-party site is convenience, a custom domain makes it much less so.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#96

Post by boardwaalk »

hughes wrote: post #82
boardwaalk wrote: post #78

fail2ban[1] can be set up to do this trivially. [1] https://www.fail2ban.org/

ok I'm like 8 pages into the configuration wiki and still have no idea how to set this up

I'd recommend just installing it and turning on a couple of the built-in filters by editing /etc/fail2ban/jail.local to see how it goes together. See the comment at the top of /etc/jail.conf as well and check out 'man jail.conf'.

Essentially to do the same thing as URL Canary you'd set up an action that only emails and trigger that with a custom filter that scans your web server's access log for accesses to a particular URL.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#97

Post by cottsak »

How does a potential customer know how effective this is? How do you even know that it's effective for your personal use case as described https://urlcanary.com/about ?

How many attackers are going to click that link or any link for that matter? Seems the value prop of the product is based on the assumption that folks will click. Maybe it's a solid assumption. I just can't see the evidence for it.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#98

Post by imglorp »

cottsak wrote: post #97

How does a potential customer know how effective this is? How do you even know that it's effective for your personal use case as described https://urlcanary.com/about ? How many attackers are going to click that link or any link for that matter? Seems the value prop of the product is based on the assumption that folks will click. Maybe it's a solid assumption. I just can't see the evidence for it.

The value lies in sometimes demonstrating a channel is insecure. It won't always do so. Obviously the converse--proving a channel is secure--is much harder.

I don't think it has commercial value really. But for social awareness, showing that mail, or notes, or storage providers aren't always as private as you'd hope, that's where the value is.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#99

Post by cottsak »

imglorp wrote: post #98
cottsak wrote: post #97

How does a potential customer know how effective this is? How do you even know that it's effective for your personal use case as described https://urlcanary.com/about ? How many attackers are going to click that link or any link for that matter? Seems the value prop of the product is based on the assumption that folks will click. Maybe it's a solid assumption. I just can't see the evidence for it.

The value lies in sometimes demonstrating a channel is insecure. It won't always do so. Obviously the converse--proving a channel is secure--is much harder. I don't think it has commercial value really. But for social awareness, showing that mail, or notes, or storage providers aren't always as private as you'd hope, that's where the value is.

But it demonstrates nothing if no one clicks. The channel may be insecure, compromised and no one knows - not the author or the parties who are supposed to have the secrets.

I see what he's trying to do, but this isn't the way I don't think. Mathematical proofs that verify that a payload is observed, opened, or accessed work. They are deterministic. They are also way more complex. I think this is trying to solve a problem in a simple way but it's still just as nondeterministic as without this solution IMO.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#100

Post by cottsak »

bb88 wrote: post #90
makarhum wrote: post #37

Similar idea than https://uriteller.io . This is nice way to check whether your end to end encrypted chat is really secure or not.

This is brilliant. They recommend using a url shortener, but I want to see if anyone is parsing comments and visiting urls from HN. https://uriteller.io/7S6asCJSwrOzApjG84hIRA Edited to add: Here's the view key if you're interested. Just append it to the end of uriteller.io: ZBt0gGoUHtIsyQ7KFwikYg A crawler on AWS hit it two minutes after I posted it.

Lots of Mac users with out of date OS :S https://uriteller.io/ZBt0gGoUHtIsyQ7KFwikYg
Post reply on HN