Show HN: URL Canary – Get an alert when someone finds your secrets

Check out https://medium.com/@grantm/obtaining-instant-breach-transpar... for some more info about how this might be possible.

It's still unclaimed I believe: http://ownme.ipredator.se

There’s a reason companies use bug bounty platforms instead of just having a bunch of bitcoins lying around.

Code can be found here: https://github.com/kale/image-cache-logger

https://uriteller.io/7S6asCJSwrOzApjG84hIRA

Edited to add:

Here's the view key if you're interested. Just append it to the end of uriteller.io:

ZBt0gGoUHtIsyQ7KFwikYg

A crawler on AWS hit it two minutes after I posted it.

EDIT: I believe it's because the CSPRNG state ( https://metacpan.org/pod/Bytes::Random::Secure::Tiny ) was created before the process forks, so they shared the initial state and generated the same token. I've reduced it to 1 worker pending an actual fix.

Sorry about that, and thanks for pointing it out.

Monitor the URL for access. You then receive an alert that someone accessed the URL.

This gives you a real-time notification that a reverse engineer has looked at your firmware. It also gives you an IP address. So you now “know” that someone might try to hack your device. And you also have an IP address.

This is a billion dollar security play!

Jokes aside. It is a good concept for IoT firms who have a security advocate, but no budget. Would help persuade people that there are hackers targeting their devices/apps with quantifiable data of degrading value.

If the URL gets accessed at all, you will know your secret has been leaked.

MyURL.com/101/passwords /private /logins

Is the idea that you'd embed this in a way that it is automatically triggered? Or that you would leave it in plaintext somewhere and assume someone would eventually visit it if they were snooping around your stuff?

But of course that heavily depends on the use case

You can also register your own domain and point it at my server and your canary will work just fine on that domain.

If you're playing at a high enough level that you've specifically blackholed URL Canary traffic by IP address, then you're a worthy adversary. And additionally, that is a splendid problem for my project to have.

On the enterprise tier you even get your own server with its own IP address, so there should be nothing linking it to URL Canary at all. (Although the enterprise tier is extremely expensive, and if anyone buys it I will probably panic).

Although the generated URLs don't have "canary token" in them.

I don't think it has commercial value really. But for social awareness, showing that mail, or notes, or storage providers aren't always as private as you'd hope, that's where the value is.

It could go in backups, in your git repository, bug tracker, internal wiki, etc.

For an average non-techy, I don't know... they might want to put one in their diary?

    while echo -en "HTTP/1.1 200 OK\r\n..." | nc -l $IP $PORT; do
        cat $MESSAGE | sendmail -i -t
    done