Hacker News Reader

Comment by jgrahamc | Hacker News Reader

I think that's a good idea, but I didn't realize (at the time I created my canary mail) that it would be possible for me to write a Google Gadget inside Gmail that would do this sort of thing. It turns out that it would be possible to have a Gadget that reports the IP address when the UI is loaded and from that an interesting service could be built. From there I could probably do similar work for other online services.

I can imagine paying for a 'cloud watch' service that keeps an eye on all my online accounts and tells me if something odd is happening.

View on HN

The problem is, once such an online service is well known, the hackers could just blacklist the host name(s) to the service so no alerting messages are sent. I think this is something that would have to live on the actual Gmail servers so it is not detectable from the client-side.

The problem is, once such an online service is well known, the hackers could just blacklist the host name(s) to the service so no alerting messages are sent.

Agreed, this is another problem. However, I think that it also depends on who you think might be targeting you. I know that a few years ago, plenty of everyday non-technical folks "hacked" their ex-girlfriend or boyfriends' accounts by doing a password reset with known details.

If the aim is to get notified of similar issues (e.g. my home laptop accessing during office hours), such a service could have merit.

The other catch with the ex-girlfriend/boyfriend is that they are not really after bank details so the Barclay's email won't interest them as it would the professional criminal... The problem with the canary is that it is trying to tailor a trap to someone without knowing much about them.

Which is another reason why the IP-based approach works better.

The IP-based approach seems flawed from my pov as someone who travels often. I'm always checking in from various IP addresses. Even locals who like to log in from the nearest cafe would get false positives, while the canary approach is more targeted.

You would get a false positive just after logging in from an unknown IP, but you would also know that it was due to your own actions (and could therefore ignore it).

Reply on news.ycombinator.com