Show HN: URL Canary – Get an alert when someone finds your secrets

https://urlcanary.com/

by jstanley • 8 years ago

273 116 8 years ago

urlcanary.com

ada19814• 8 years ago

This is neat.

For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.

jstanley15• 8 years ago

Great idea! Might even be possible to sort that out for the user automatically...

mikejarema• 8 years ago

The bit.ly approach might result in false positives as the namespace for bit.ly links is quite easy to iterate over (assuming you don't use a custom link).

Also, doesn't bit.ly access a URL to pull a title or generate a preview? This would send a click through to the canary as well.

rplnt2• 8 years ago

Doesn't bit.ly access the url? Either at creation time or at any point later on?

mikey_p• 8 years ago

That doesn't fully obscure the original URL though, it's very easy to issue a HEAD request and examine the headers first.

sorenjan2• 8 years ago

You can preview bit.ly links by appending a + to it.

jstanley15• 8 years ago

But if you are already suspicious enough that you want to do that, you were never going to click on the original URL anyway, so it's no worse than not using bit.ly.

raverbashing• 8 years ago

I usually curl shortened urls, the response is either a 301/302 or an html page with a redirect (usually the latter)

ada19814• 8 years ago

If you preview a link, wouldn't it then require the bit.ly to fetch it? Or does bit.ly serve a cached copy?

gruez• 8 years ago

who puts a bit.ly link alongside their secrets?

ada19814• 8 years ago

If you can use any domain you like, that is great.

MyURL.com/101/passwords /private /logins

Is the idea that you'd embed this in a way that it is automatically triggered? Or that you would leave it in plaintext somewhere and assume someone would eventually visit it if they were snooping around your stuff?

jstanley15• 8 years ago

You can use any domain you like, although I don't think I've documented that. Just point any domain at 46.101.33.42 and it'll work.

(But obviously it needs to be a hostname you're not already using for something else).

josefresco• 8 years ago

This looks neat. What is a good use-case for your average techy? What about your average non-techy?

jstanley15• 8 years ago

It can be useful anywhere you have sensitive information that you wouldn't want to fall into the wrong hands, or more specifically that you would want to find out if it did.

It could go in backups, in your git repository, bug tracker, internal wiki, etc.

For an average non-techy, I don't know... they might want to put one in their diary?

rplnt2• 8 years ago

For any web/cloud service, I think this might be easily triggered when the service is trying to be helpful. I.e. when fetching previews, displaying in/active links, etc...

diggan• 8 years ago

I don't understand this. Someone just visits the URL and I get a email notification? If it's supposed to be secret, how does the script knows if the visit is OK or not, sending me the notification only when it's OK? Are the good guys supposed to know this is a sort of "honeypot" URL and not visit it?

jstanley15• 8 years ago

You won't share the URL in a public place, you'll store it alongside whatever you're trying to keep safe.

If the URL gets accessed at all, you will know your secret has been leaked.

dsacco3• 8 years ago

Friendly feedback, coming from a reverse engineer: the commenter who also answered this question gave a really good, concrete example of how this could be used in the context of DRM. When I visited your page I was initially perplexed as to why you’d want any of this. You should include a specific example of how this service delivers value, and the reverse engineering example is a good one.

droopybuns2• 8 years ago

Put a URL in a firmware image that is never called by your device/app.

Monitor the URL for access. You then receive an alert that someone accessed the URL.

This gives you a real-time notification that a reverse engineer has looked at your firmware. It also gives you an IP address. So you now “know” that someone might try to hack your device. And you also have an IP address.

This is a billion dollar security play!

Jokes aside. It is a good concept for IoT firms who have a security advocate, but no budget. Would help persuade people that there are hackers targeting their devices/apps with quantifiable data of degrading value.

dsacco3• 8 years ago

Huh. That’s...a good idea. The idea has to be developed further though. This has to be deployed on different domain names and with full content control on the web pages.

I guess that’s all doable with the “private server with root access” under enterprise pricing. What a great way to precisely measure cover time. You could inject arbitrary URLs into an application to see if your API has been reverse engineered.

gricardo99• 8 years ago

You could also put it in something like your 1Password Vault. Although, if that's been hacked/accessed, you may not have time to save yourself.

dylanpyle• 8 years ago

FYI - I signed up and the email confirmation page showed me someone else's canary URL

jstanley15• 8 years ago

That's not good! Taking a look.

EDIT: I believe it's because the CSPRNG state ( https://metacpan.org/pod/Bytes::Random::Secure::Tiny ) was created before the process forks, so they shared the initial state and generated the same token. I've reduced it to 1 worker pending an actual fix.

Sorry about that, and thanks for pointing it out.

beefhash2• 8 years ago

Given this kind of disaster potential, wouldn't it be a rather attractive option to use /dev/urandom?

bmm6o• 8 years ago

There was a recent discussion about (not) sharing CSPRNG state with fork-ed processes: https://news.ycombinator.com/item?id=15759855

moltar2• 8 years ago

+1 for using Perl

Care to share your stack?

pinum2• 8 years ago

This implies that you should probably invalidate all URLs created before you applied that mitigation, right? Or do you have some way (logs?) of knowing which ones were compromised?

oh_sigh• 8 years ago

Well, did you go to the URL so that that user will know they used an insecure service?

brianwawok• 8 years ago

They forgot to dogfood their own product

magic_beans• 8 years ago

I like the simplicity of this.

JamesMcain• 8 years ago

how does this differ from https://canarytokens.org/generate ?

jstanley15• 8 years ago

Very little!

Although the generated URLs don't have "canary token" in them.

mh_2• 8 years ago

Canarytoken allows you to download a docker instance, so you can host the server on any domain you like.

rrggrr• 8 years ago

A quick test using Zapier's webhook functionality tells me I can duplicate this with their platform. Doesn't seem to work with link shortener, but I have the sense more time invested on that will yield a result. So, I think the concept has merit but you're off center of the target and much more value is required.

wongarsu• 8 years ago

I imagine there's a lot of value to be found in a dashboard, or generally in managing these canaries. Which canary was deployed where, how often are they triggered (with the ability to mark some instances as false alarm) etc.

But of course that heavily depends on the use case

CamTin• 8 years ago

You might think about embedding bounties in crypto blockchains. For example, create BTC wallets that can be unlocked using a secret sitting next to (or steganographically embedded in) the secret you're trying to protect. This gives the person uncovering the secret an incentive to activate the canary. {RI,MP}AA are apparently doing this with their music and movies, so they know when they are showing up on pirate sites.

foepys• 8 years ago

As skeptical as I am about crypto currencies, this is a really interesting application. Basically exploiting human greed. Thank you for sharing it.

sli2• 8 years ago

That's some awfully pessimistic and dehumanizing language. I just consider it to be paying someone for the trouble rather than jumping straight to "exploiting greed."

hardly_a_mirage• 8 years ago

I'm interested in understanding how the RIA/MPAA canary works. Can you please elaborate or provide an explanatory link?

marcc• 8 years ago

I think this is a great idea and a great use of a BTC/LTC wallet. Breach notification often doesn't happen in a timely manner, and building a solution like this let's me, the consumer, get notified even when the vendor with the secrets doesn't send the notification.

Check out https://medium.com/@grantm/obtaining-instant-breach-transpar... for some more info about how this might be possible.

zapita• 8 years ago

The MirageOS project has done this, they call it the "Bitcoin Piñata".

It's still unclaimed I believe: http://ownme.ipredator.se

elorm• 8 years ago

Claimed today I believe. Possibly inspired by your post

amenghra• 8 years ago

You’ll notice someone gained access to your system (because the money will disappear) but you’ll have zero clue how they did it. Also, how do you prevent an employee from stealing the funds for themselves?

There’s a reason companies use bug bounty platforms instead of just having a bunch of bitcoins lying around.

admax88q• 8 years ago

But there has to be some way we can solve this with the blockchain. /sarcasm

efficax• 8 years ago

Will the canary URLs always be to the same domain? If so, can't I circumvent this just by using custom dns locally to map that domain to somewhere else, like localhost? If it's not a domain, but an IP address, can't I just route that IP somewhere else?

jstanley15• 8 years ago

There are currently 3 domains available. If this takes off I could do something like mailinator (offer the user a small selection, but never reveal the full list at once).

You can also register your own domain and point it at my server and your canary will work just fine on that domain.

If you're playing at a high enough level that you've specifically blackholed URL Canary traffic by IP address, then you're a worthy adversary. And additionally, that is a splendid problem for my project to have.

On the enterprise tier you even get your own server with its own IP address, so there should be nothing linking it to URL Canary at all. (Although the enterprise tier is extremely expensive, and if anyone buys it I will probably panic).

sitkack• 8 years ago

Do you have domain diversity? Organizations will blackhole urlcanary.com

andrewmcwatters• 8 years ago

Hah, that enterprise pricing is insane.

ovao• 8 years ago

Given the custom feature development, potentially not.

jessaustin• 8 years ago

Some organizations have really high in-house costs...

CapacitorSet2• 8 years ago

Indeed, at £1k (€1136, $1403) one might as well run an internal application. At a very basic level, it can be achieved with three lines of bash:

    while echo -en "HTTP/1.1 200 OK\r\n..." | nc -l $IP $PORT; do
        cat $MESSAGE | sendmail -i -t
    done

More complex configurations could still be worked out in <50 lines of Python.

softawre2• 8 years ago

Why would anybody buy this (dropbox), I can recreate this with a simple ftp server and 30 minutes of coding!

Kiro2• 8 years ago

Maybe I don't understand the concept but why would you ever put a secret public?

dewey2• 8 years ago

You don't. You put it in a thought to be private place but you'll find out if it gets public at some point that way.

Kiro2• 8 years ago

But why host it somewhere reachable at all?

makarhum• 8 years ago

Similar idea than https://uriteller.io. This is nice way to check whether your end to end encrypted chat is really secure or not.

jstanley15• 8 years ago

Uri Teller is a perfect name, that's brilliant.

softawre2• 8 years ago

Also a lot better for simple use cases since it doesn't require an email address.

bb882• 8 years ago

This is brilliant. They recommend using a url shortener, but I want to see if anyone is parsing comments and visiting urls from HN.

https://uriteller.io/7S6asCJSwrOzApjG84hIRA

Edited to add:

Here's the view key if you're interested. Just append it to the end of uriteller.io:

ZBt0gGoUHtIsyQ7KFwikYg

A crawler on AWS hit it two minutes after I posted it.

cottsak3• 8 years ago

Lots of Mac users with out of date OS :S https://uriteller.io/ZBt0gGoUHtIsyQ7KFwikYg

dorgo3• 8 years ago

I clicked the link, but I'm not a bot, I swear!

duck• 8 years ago

I created a similar idea a while back when Gmail started caching images. The main advantage is the image itself contains the log: http://cache-logger.herokuapp.com/hello-world

Code can be found here: https://github.com/kale/image-cache-logger

ActsJuvenile• 8 years ago

Great project! I just found out that one creepy Safari extension is crawling every URL I visit.

Also Yahoo Slurp is crawling my email URLs. Sigh.

Volt• 8 years ago

What's the extension?

overcast• 8 years ago

Is following a URL common practice for someone who accesses documents? I mean if I come across a repository, my first inclination isn't to find all of the hidden URL's and chase them.

inetknght• 8 years ago

It's common practice for robots and vulnerability analysis

sli2• 8 years ago

So what happens when the three offered domains become widely known to be fake? Can this service be federated and use custom domains or is it just another game of whack-a-mole?

pwinnski• 8 years ago

From the landing page: "...and it's easy to setup a URL Canary on a custom domain name."

pinum2• 8 years ago

Not to be overly negative, but if you're going to the trouble of pointing a custom domain to this service, couldn't you just write a quick PHP script that mail()s out when it's accessed? As far as I can see, the only advantage of using this third-party site is convenience, a custom domain makes it much less so.

lolc• 8 years ago

Nice! I've often considered implementing a service like this at the DNS level. DNS would be ideal because it would work for more services, not only HTTP.

nzjrs• 8 years ago

Semi related asking the wizard of HN. I recall reading a similar trick whereby one can embed a github key/token/api key/??? In a source file in one's repository and then if your code ever is stolen and pushed to github then you will receive a notification because github will revoke the token. Does this or similar ring a bell for anyone?

shurcooL• 8 years ago

https://blog.github.com/2015-02-05-keeping-github-oauth-toke...

zitterbewegung• 8 years ago

This is neat. Reminds me of the MR robot episode where he puts a link to track the FBI in season 3

tzury• 8 years ago

given the options are 3 domains to choose from:

  1. emotionalrec.com
  2. factwisdom.com
  3. tdurl.uk

Smart thief simply won't follow the link.

jstanley15• 8 years ago

Even then you're no worse off than if you didn't have it at all.

boardwaalk2• 8 years ago

fail2ban[1] can be set up to do this trivially.

[1] https://www.fail2ban.org/

hughes• 8 years ago

ok I'm like 8 pages into the configuration wiki and still have no idea how to set this up

boardwaalk2• 8 years ago

I'd recommend just installing it and turning on a couple of the built-in filters by editing /etc/fail2ban/jail.local to see how it goes together. See the comment at the top of /etc/jail.conf as well and check out 'man jail.conf'.

Essentially to do the same thing as URL Canary you'd set up an action that only emails and trigger that with a custom filter that scans your web server's access log for accesses to a particular URL.

cottsak3• 8 years ago

How does a potential customer know how effective this is? How do you even know that it's effective for your personal use case as described https://urlcanary.com/about ?

How many attackers are going to click that link or any link for that matter? Seems the value prop of the product is based on the assumption that folks will click. Maybe it's a solid assumption. I just can't see the evidence for it.

imglorp2• 8 years ago

The value lies in sometimes demonstrating a channel is insecure. It won't always do so. Obviously the converse--proving a channel is secure--is much harder.

I don't think it has commercial value really. But for social awareness, showing that mail, or notes, or storage providers aren't always as private as you'd hope, that's where the value is.

cottsak3• 8 years ago

But it demonstrates nothing if no one clicks. The channel may be insecure, compromised and no one knows - not the author or the parties who are supposed to have the secrets.

I see what he's trying to do, but this isn't the way I don't think. Mathematical proofs that verify that a payload is observed, opened, or accessed work. They are deterministic. They are also way more complex. I think this is trying to solve a problem in a simple way but it's still just as nondeterministic as without this solution IMO.

wxyyxc1992• 8 years ago

this is a really interesting application. Basically exploiting human greed. Thank you for sharing it.

askvictor• 8 years ago

I'd really like to see a generalisation of this idea to any personal/private data stored in any database. Any time a piece of 'your' data (e.g. a medical record) is accessed, you get an alert. There could be an industry of alert brokers that decide if the alert is important or not - you might employ one, or write your own, or choose to look at every alert. While it would require a big change to how we store data, I suspect that the changes required to be GDPR compliant start going in this sort of direction.

mh_2• 8 years ago

This is neat.. Its currently a single type of token (ie. a URL).

If you check out https://canarytokens.org you will notice the ability to create several others (be notified when someone resolves an IP address, be notified when someone opens a file, be notified when someone views a QR code, etc)

Show HN: URL Canary – Get an alert when someone finds your secrets

Related Stories