Hacker News Reader

Comment by ada1981 | Hacker News Reader

ada1981

This is neat.

For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.

You can preview bit.ly links by appending a + to it.

But if you are already suspicious enough that you want to do that, you were never going to click on the original URL anyway, so it's no worse than not using bit.ly.

Not true. I know bitly and googl have those info pages, so I'll check them out when I am curious but am not sure whether I want to alert whereever it leads. I know I'll get more info at best, and don't lose anything at worst. For random URLs, I guess I could try whois lookups, but I'd be much more likely to just check it out than with a short URL which is easily checked out.

I think you missed my point.

If seeing that the bit.ly URL redirects to a known-urlcanary domain would put you off visiting the URL, then seeing the raw known-urlcanary domain (not behind bit.ly) would also be enough to put you off visiting it.

Ah, yes, if that is the alternative, then of course. I thought it was between some shortened link and an unknown domain.

So, doesn't this mean you need to have a bunch of domains, none of which look like urlcanary domains? If you hide behind something like namecheap's whoisguard (customer, not affiliated with them), that would do the trick, right?

It's easy to integrate in a scraping script though, which I thought was what this was supposed to combat.

I usually curl shortened urls, the response is either a 301/302 or an html page with a redirect (usually the latter)

If you preview a link, wouldn't it then require the bit.ly to fetch it? Or does bit.ly serve a cached copy?

Doesn't bit.ly access the url? Either at creation time or at any point later on?

If you can use any domain you like, that is great.

MyURL.com/101/passwords /private /logins

Is the idea that you'd embed this in a way that it is automatically triggered? Or that you would leave it in plaintext somewhere and assume someone would eventually visit it if they were snooping around your stuff?

You can use any domain you like, although I don't think I've documented that. Just point any domain at 46.101.33.42 and it'll work.

(But obviously it needs to be a hostname you're not already using for something else).

Thanks!

Sorry to offer unsolicited advice, but are you sure you wanna use a fixed IP for that? Seems more reasonable to ask people to CNAME to a domain you guarantee will always point to the correct servers.

This means you don't break the system when you move IP address. Moreover, should you ever need to, you can round-robin the domain for either reliability or load-balancing (though I doubt that would be necessary).

If you are serious about testing this, someone will just DDOS the ip and the monitoring is offline for everyone.

That doesn't fully obscure the original URL though, it's very easy to issue a HEAD request and examine the headers first.

Great idea! Might even be possible to sort that out for the user automatically...

The bit.ly approach might result in false positives as the namespace for bit.ly links is quite easy to iterate over (assuming you don't use a custom link).

Also, doesn't bit.ly access a URL to pull a title or generate a preview? This would send a click through to the canary as well.

who puts a bit.ly link alongside their secrets?

Reply on news.ycombinator.com