URL Canary
Security and privacy
canary tokens
SHOW HN2018
How HN took it
16 positive, 24 neutral or asking, 2 mixed, 22 critical, out of 64 comments about the project. Thread score -0.07.
Idea: 12 for, 12 againstPrivacy: 1 for, 5 againstExecution: 0 for, 3 againstPricing: 0 for, 2 againstDesign: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Simple, clever concept
From 2 comments
I like the simplicity of this.
magic_beans on HNThis is neat. For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.
ada1981 on HN
Useful for reverse engineering and DRM detection
From 2 comments
Friendly feedback, coming from a reverse engineer: the commenter who also answered this question gave a really good, concrete example of how this could be used in the context of…
dsacco on HNPut a URL in a firmware image that is never called by your device/app. Monitor the URL for access. You then receive an alert that someone accessed the URL. This gives you a…
droopybuns on HN
Objections
Organizations can blackhole the domains
From 2 comments
Do you have domain diversity? Organizations will blackhole urlcanary.com
sitkack on HNWill the canary URLs always be to the same domain? If so, can't I circumvent this just by using custom dns locally to map that domain to somewhere else, like localhost? If it's…
efficax on HN
Attackers may not click links
From 1 comment
How does a potential customer know how effective this is? How do you even know that it's effective for your personal use case as described https://urlcanary.com/about ? How many…
cottsak on HN
Enterprise pricing seems too high
From 1 comment
Hah, that enterprise pricing is insane.
andrewmcwatters on HN
Requests
Use custom domains and more domain diversity
From 2 comments
So what happens when the three offered domains become widely known to be fake? Can this service be federated and use custom domains or is it just another game of whack-a-mole?
sli on HNThere are currently 3 domains available. If this takes off I could do something like mailinator (offer the user a small selection, but never reveal the full list at once). You…
jstanley on HN
Questions
How does it differ from canarytokens.org
From 1 comment
how does this differ from https://canarytokens.org/generate ?
JamesMcain on HN
Alternatives named
canarytokens.org
From 2 comments
how does this differ from https://canarytokens.org/generate ?
JamesMcain on HNThis is neat.. Its currently a single type of token (ie. a URL). If you check out https://canarytokens.org you will notice the ability to create several others (be notified when…
mh_ on HN
uriteller.io
From 1 comment
Similar idea than https://uriteller.io. This is nice way to check whether your end to end encrypted chat is really secure or not.
makarhum on HN