Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: URL Canary – Get an alert when someone finds your secrets

urlcanary.com

Post reply on HN
Print view View original

101–110 of 122 posts

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#101

Post by amenghra »

CamTin wrote: post #19

You might think about embedding bounties in crypto blockchains. For example, create BTC wallets that can be unlocked using a secret sitting next to (or steganographically embedded in) the secret you're trying to protect. This gives the person uncovering the secret an incentive to activate the canary. {RI,MP}AA are apparently doing this with their music and movies, so they know when they are showing up on pirate sites…

You’ll notice someone gained access to your system (because the money will disappear) but you’ll have zero clue how they did it. Also, how do you prevent an employee from stealing the funds for themselves?

There’s a reason companies use bug bounty platforms instead of just having a bunch of bitcoins lying around.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#102

Post by wolco »

scott_s wrote: post #77
sli wrote: post #53

Earlier quoted context omitted.

That's some awfully pessimistic and dehumanizing language. I just consider it to be paying someone for the trouble rather than jumping straight to "exploiting greed."

Since the person profiting is someone who obtained the secret through shady means - either breaking into an insecure system, or taking advantage of their access to a system which doesn't encrypt passwords - I don't consider it pessimistic or dehumanizing to describe the behavior as greed.

Greed is a subjective term. The company who is charging money could be described as greedy for making a profit when they could have lowered the price to remove any excess profit. Why is the person who understands and uses the system in a way it wasn't intented greedy?

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#103

Post by admax88q »

amenghra wrote: post #101
CamTin wrote: post #19

You might think about embedding bounties in crypto blockchains. For example, create BTC wallets that can be unlocked using a secret sitting next to (or steganographically embedded in) the secret you're trying to protect. This gives the person uncovering the secret an incentive to activate the canary. {RI,MP}AA are apparently doing this with their music and movies, so they know when they are showing up on pirate sites…

You’ll notice someone gained access to your system (because the money will disappear) but you’ll have zero clue how they did it. Also, how do you prevent an employee from stealing the funds for themselves? There’s a reason companies use bug bounty platforms instead of just having a bunch of bitcoins lying around.

But there has to be some way we can solve this with the blockchain. /sarcasm

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#105

Post by askvictor »

I'd really like to see a generalisation of this idea to any personal/private data stored in any database. Any time a piece of 'your' data (e.g. a medical record) is accessed, you get an alert. There could be an industry of alert brokers that decide if the alert is important or not - you might employ one, or write your own, or choose to look at every alert. While it would require a big change to how we store data, I suspect that the changes required to be GDPR compliant start going in this sort of direction.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#106

Post by beefhash »

stouset wrote: post #85
jstanley wrote: post #35

Earlier quoted context omitted.

Bytes::Random::Secure::Tiny seeds itself from /dev/urandom, I just need to make sure to initialise it on first use, instead of when my program first starts (which I've now done). In general I suspect if anything you'd be more likely to mess it up by reading bytes from /dev/urandom manually than by using a library.

How exactly can one mess up reading bytes from `/dev/urandom`? Serious question. Open the file. Read from it. If no failures on open or read, you have random bytes. In essence, there is already a library for this: `open` and `read`, which seems to be the same API surface area as this library.

Here's all the ways this can possibly go wrong:

https://insanecoding.blogspot.com/2014/05/a-good-idea-with-b...

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#107

Post by dorgo »

sli wrote: post #53
foepys wrote: post #45

Earlier quoted context omitted.

As skeptical as I am about crypto currencies, this is a really interesting application. Basically exploiting human greed. Thank you for sharing it.

That's some awfully pessimistic and dehumanizing language. I just consider it to be paying someone for the trouble rather than jumping straight to "exploiting greed."

Strange. I feel only a slight negative connotation of "greed". Nothing to be ashamed of or to condemn. Maybe some meaning is lost in translation to my language.

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#108

Post by dorgo »

bb88 wrote: post #90
makarhum wrote: post #37

Similar idea than https://uriteller.io . This is nice way to check whether your end to end encrypted chat is really secure or not.

This is brilliant. They recommend using a url shortener, but I want to see if anyone is parsing comments and visiting urls from HN. https://uriteller.io/7S6asCJSwrOzApjG84hIRA Edited to add: Here's the view key if you're interested. Just append it to the end of uriteller.io: ZBt0gGoUHtIsyQ7KFwikYg A crawler on AWS hit it two minutes after I posted it.

I clicked the link, but I'm not a bot, I swear!

Re: Show HN: URL Canary – Get an alert when someone finds your secrets

#109

Post by dorgo »

rplnt wrote: post #8
jstanley wrote: post #5

Earlier quoted context omitted.

It can be useful anywhere you have sensitive information that you wouldn't want to fall into the wrong hands, or more specifically that you would want to find out if it did. It could go in backups, in your git repository, bug tracker, internal wiki, etc. For an average non-techy, I don't know... they might want to put one in their diary?

For any web/cloud service, I think this might be easily triggered when the service is trying to be helpful. I.e. when fetching previews, displaying in/active links, etc...

lol, just add a captcha to the trap page :D
Post reply on HN