Yet another Hacker News

65 points wiradikusuma 2 hours ago 11 comments

https://docs.canarytokens.org/guide/

charlesabarnes 1 hour ago | parent

I think this service is already pretty good, but when defending against LLM based attacks, they're a godsend. Current tools don't appear to be too discerning.

direwolf20 1 hour ago | parent

They make credit cards. Obviously they're not real cards but what sort of financial wizardry is required to make that possible? And given it's vibecoded that means Claude knows how to make fake credit cards now?

xx_ns 1 hour ago | parent

> given it's vibecoded

Why is this a given? This service has been around for longer than LLMs have been a thing.

ASalazarMX 43 minutes ago | parent

Vibecoding has seriously eroding the trust we have in public software. Hopefully there's some of badge projects can use to clarify how much Ai was in charge of it.

- No LLMs

- LLMs as tools

- LLMs decided some things

- YOLO vibecoded

bstsb 1 hour ago | parent

this is absolutely not a given, i've been using canarytokens for years!

blog posts date back to at least 2015: https://leonjza.github.io/blog/2015/09/10/canarytokens---the...

rafram 1 hour ago | parent

There are many, many services for programmatically issuing credit cards that you can control from code. For example: https://stripe.com/issuing

f311a 1 hour ago | parent

> given it's vibecoded

I've been using it since 2015

maxmcl12 53 minutes ago | parent

They’re real virtual cards actually. Source: I added the feature

dang 1 hour ago | parent

Related. Others?

Canarytokens: Honeypot for critical credentials, get notified when they are used (2015) - https://news.ycombinator.com/item?id=41107209 - July 2024 (42 comments)

Canary Tokens - https://news.ycombinator.com/item?id=34157751 - Dec 2022 (59 comments)

A “Safety Net” for AWS Canarytokens - https://news.ycombinator.com/item?id=33644351 - Nov 2022 (1 comment)

Canarytokens - https://news.ycombinator.com/item?id=31914078 - June 2022 (3 comments)

An insanely easy-to-use honeypot solution that deploys in just four minutes - https://news.ycombinator.com/item?id=30374561 - Feb 2022 (4 comments)

Canarytokens – honeypot tokens that tell you when someone used them - https://news.ycombinator.com/item?id=15778011 - Nov 2017 (1 comment)

AlexErrant 1 hour ago | parent

Any idea on how to roll-your-own canary token for an unsupported token provider like Cloudflare/Stripe/OpenAI? Do you just make a real Cloudflare/Stripe/OpenAI account, create an API key, and vibecode an alerting system?

I'm kinda surprised that they haven't expanded beyond their existing token providers.

skinfaxi 1 hour ago | parent

That's the issue. If the first-parties don't provide a means to mint canaries you have to mint your own real keys.