Canary Tokens

Posted by wiradikusuma 17 hours ago

https://docs.canarytokens.org/guide/

Comments

Comment by dang 17 hours ago

Related. Others?

Canarytokens: Honeypot for critical credentials, get notified when they are used (2015) - https://news.ycombinator.com/item?id=41107209 - July 2024 (42 comments)

Canary Tokens - https://news.ycombinator.com/item?id=34157751 - Dec 2022 (59 comments)

A “Safety Net” for AWS Canarytokens - https://news.ycombinator.com/item?id=33644351 - Nov 2022 (1 comment)

Canarytokens - https://news.ycombinator.com/item?id=31914078 - June 2022 (3 comments)

An insanely easy-to-use honeypot solution that deploys in just four minutes - https://news.ycombinator.com/item?id=30374561 - Feb 2022 (4 comments)

Canarytokens – honeypot tokens that tell you when someone used them - https://news.ycombinator.com/item?id=15778011 - Nov 2017 (1 comment)

Comment by charlesabarnes 17 hours ago

I think this service is already pretty good, but when defending against LLM based attacks, they're a godsend. Current tools don't appear to be too discerning.

Comment by maxmcl12 15 hours ago

Thanks! We also think they’re one of the few things available that work well for agentic threats.

You might find some recent work we did on agent deception interesting as well: https://blog.thinkst.com/2026/09/getting-agents-to-tell-on-t...

Comment by hankyone 14 hours ago

I’m using the concept across AI infra in my own project https://canarygrid.shadesec.com

Comment by AlexErrant 17 hours ago

Any idea on how to roll-your-own canary token for an unsupported token provider like Cloudflare/Stripe/OpenAI? Do you just make a real Cloudflare/Stripe/OpenAI account, create an API key, and vibecode an alerting system?

I'm kinda surprised that they haven't expanded beyond their existing token providers.

Comment by mslaviero 12 hours ago

We look at several factors before adding new Canarytoken API key types to canarytokens.org:

1. Can we create/remove keys programmatically at scale cheaply? Most sites aren't geared up to handle tens or hundreds of thousands of API keys tied to a single account. If the per-account limits are low then we have to build infra to manage multiple accounts.

2. Can we defang the keys so that there is no risk to them being discovered?

3. Does the service provide a near real-time audit log to pinpoint when an individual key was used? Ideally the audit log also includes IP information.

4. Does the service provide a mechanism to trigger audit events, or do we need to poll the service for the audit logs?

5. Would most attackers recognise the API key and want to try it?

Most services fail one or more of these.

Comment by skinfaxi 17 hours ago

That's the issue. If the first-parties don't provide a means to mint canaries you have to mint your own real keys.

Comment by MisterMunchkin 15 hours ago

That’s a really good idea, I love that they even do fake bank cards.

I feel like a self-hosted version would be better though. Having to phone home to their servers could give the game away.

Comment by maxmcl12 14 hours ago

You can totally host it yourself!

https://github.com/thinkst/canarytokens

Comment by singularity2001 5 hours ago

how do they distinguish 'attackers' from usual crawlers?

Comment by direwolf20 17 hours ago

They make credit cards. Obviously they're not real cards but what sort of financial wizardry is required to make that possible? And given it's vibecoded that means Claude knows how to make fake credit cards now?

Comment by linsomniac 14 hours ago

>Claude knows how to make fake credit cards now

If by "fake" you mean ones that pass number validation on web sites, that's easy. I wrote python code to check and generate valid numbers back in the '90s; it's a simple, well known check digit algorithm appended at the end. https://en.wikipedia.org/wiki/Luhn_algorithm.

Comment by suburban_strike 13 hours ago

Anytime a company pisses me off I set up a while loop to generate Luhn-compliant 16-digit numbers and spam them on every html form on the site.

PCI audits are fun for everyone

Comment by direwolf20 14 hours ago

No I mean ones that are actually connected to Visa's network and you get an API call from Visa when someone uses them.

Comment by xx_ns 17 hours ago

> given it's vibecoded

Why is this a given? This service has been around for longer than LLMs have been a thing.

Comment by ASalazarMX 16 hours ago

Vibecoding has seriously eroding the trust we have in public software. Hopefully there's some of badge projects can use to clarify how much Ai was in charge of it.

- No LLMs

- LLMs as tools

- LLMs decided some things

- YOLO vibecoded

Comment by bigfishrunning 15 hours ago

That would require honesty and trust, which are two things that most online projects could only dream of having

Comment by maxmcl12 16 hours ago

They’re real virtual cards actually. Source: I added the feature

Comment by noman-land 15 hours ago

This feature was removed at some point and I guess added back? What happened there? It's my fav feature :).

Also what service do you use to mint endless virtual cc numbers?

Comment by maxmcl12 15 hours ago

The first version used a provider that started rate-limiting us pretty heavily. It meant a pretty crappy experience for folks creating the Canarytoken. We decided to pause and look for alternatives.

We’re using Airwallex now. They’ve been great.

You can read more about the implementation in our blogpost: https://blog.thinkst.com/2024/12/its-baaack-credit-card-cana...

Comment by bstsb 17 hours ago

this is absolutely not a given, i've been using canarytokens for years!

blog posts date back to at least 2015: https://leonjza.github.io/blog/2015/09/10/canarytokens---the...

Comment by rafram 17 hours ago

There are many, many services for programmatically issuing credit cards that you can control from code. For example: https://stripe.com/issuing

Comment by f311a 17 hours ago

> given it's vibecoded

I've been using it since 2015