5 ms·

This is neat. For added security, maybe better to hide the canary URL in a bit.ly link? Someone might know your 3 URLS.

• jstanley 9y ago
  Great idea! Might even be possible to sort that out for the user automatically...
  • mikejarema 9y ago
    The bit.ly approach might result in false positives as the namespace for bit.ly links is quite easy to iterate over (assuming you don't use a custom link). Also, doesn't bit.ly access a URL to pull a title or generate a preview? This would send a click through to the canary as well.
• rplnt 9y ago
  Doesn't bit.ly access the url? Either at creation time or at any point later on?
• mikey_p 9y ago
  That doesn't fully obscure the original URL though, it's very easy to issue a HEAD request and examine the headers first.
• sorenjan 9y ago
  You can preview bit.ly links by appending a + to it.
  • jstanley 9y ago
    But if you are already suspicious enough that you want to do that, you were never going to click on the original URL anyway, so it's no worse than not using bit.ly.
    • lucb1e 9y ago
      Not true. I know bitly and googl have those info pages, so I'll check them out when I am curious but am not sure whether I want to alert whereever it leads. I know I'll get more info at best, and don't lose anything at worst. For random URLs, I guess I could try whois lookups, but I'd be much more likely to just check it out than with a short URL which is easily checked out.
      • jstanley 9y ago
        I think you missed my point. If seeing that the bit.ly URL redirects to a known-urlcanary domain would put you off visiting the URL, then seeing the raw known-urlcanary domain (not behind bit.ly) would also be enough to put you off visiting it.
        • lucb1e 9y ago
          Ah, yes, if that is the alternative, then of course. I thought it was between some shortened link and an unknown domain.
        • e40 9y ago
          So, doesn't this mean you need to have a bunch of domains, none of which look like urlcanary domains? If you hide behind something like namecheap's whoisguard (customer, not affiliated with them), that would do the trick, right?
    • sorenjan 9y ago
      It's easy to integrate in a scraping script though, which I thought was what this was supposed to combat.
  • raverbashing 9y ago
    I usually curl shortened urls, the response is either a 301/302 or an html page with a redirect (usually the latter)
  • ada1981 9y ago
    If you preview a link, wouldn't it then require the bit.ly to fetch it? Or does bit.ly serve a cached copy?
• gruez 9y ago
  who puts a bit.ly link alongside their secrets?
• ada1981 9y ago
  If you can use any domain you like, that is great. MyURL.com/101/passwords /private /logins Is the idea that you'd embed this in a way that it is automatically triggered? Or that you would leave it in plaintext somewhere and assume someone would eventually visit it if they were snooping around your stuff?
  • jstanley 9y ago
    You can use any domain you like, although I don't think I've documented that. Just point any domain at 46.101.33.42 and it'll work. (But obviously it needs to be a hostname you're not already using for something else).
    • ada1981 9y ago
      Thanks!
    • rocqua 9y ago
      Sorry to offer unsolicited advice, but are you sure you wanna use a fixed IP for that? Seems more reasonable to ask people to CNAME to a domain you guarantee will always point to the correct servers. This means you don't break the system when you move IP address. Moreover, should you ever need to, you can round-robin the domain for either reliability or load-balancing (though I doubt that would be necessary).
      • Moru 9y ago
        If you are serious about testing this, someone will just DDOS the ip and the monitoring is offline for everyone.