5 ms·
Huh. That’s...a good idea. The idea has to be developed further though. This has to be deployed on different domain names and with full content control on the w
by dsacco 9y ago
Huh. That’s...a good idea. The idea has to be developed further though. This has to be deployed on different domain names and with full content control on the web pages.
I guess that’s all doable with the “private server with root access” under enterprise pricing. What a great way to precisely measure cover time. You could inject arbitrary URLs into an application to see if your API has been reverse engineered.
- droopybuns 9y agoHackers worth their salt work in air-gapped environments. This is a signal, but not a game changer for security pros.
- dsacco 9y agoI’m speaking specifically about the case where someone is trying to reverse engineer a private API from an application. Then interacting with an API endpoint will necessarily trigger the canary. Having retrieved API secrets offensively, and overseen secret rotation defensively, I’d say it would be a game changer. It’s an excellent idea to automate this discovery with an alarm. The current discovery system is either an internally developed, half-baked version of this that comes from sophisticated logging, or manual oversight.
- stordoff 9y agoI presume the idea is to make the URL appear to be part of the standard API (and maybe even does something useful to induce use?), but it is never actually called by a legitimate application?