3 ms·
This is a great idea and in my opinion should be a best practice for any company. We're actively working on enabling this functionality for our core data aliasi
by mahmoudimus 6y ago
This is a great idea and in my opinion should be a best practice for any company. We're actively working on enabling this functionality for our core data aliasing engine at the company where I work.
The idea is pretty cool when you start to think about adding self-destructing properties to individual pieces of data, so reasoning about data type and entropy becomes a risk modeling problem.
A concrete example: imagine if bank account numbers, credit card numbers, emails etc have self-destructing properties where there exists an outer shell "pointing" to the data but the underlying data is destroyed (using techniques like crypto-shredding et al.). The outer shell would have canary properties that work in real-word systems but since the underlying data is destroyed, all we would be left with are canary properties without the underlying data leak.
A good example of some companies that offer something similar:
- https://canarytokens.org/generate https://canarytokens.org/generate
- https://github.com/thinkst/canarytokens https://github.com/thinkst/canarytokens
- https://canary.tools/ https://canary.tools/
Pretty cool technology that can really go far.
- graystevens 6y agoWe started something similar with BreachInsider (https://breachinsider.com https://breachinsider.com) to allow businesses (or I guess individuals?) to do this themselves with minimal overhead or resources. The idea being that they sprinkle these ‘users’ throughout their databases and see where they show up, and be alerted if they ever get contacted or show up somewhere unusual (Pastebin etc.) We ran something similar, firing ‘insiders’ across many of the top 100 sites and services, to spot breaches (either in the traditional sense of security incidents, or lapses in privacy for end users).
- Canada 6y agocanarytokens.org is great. highly recommend them.