3 ms·
Well to be honest Honey Tokens is being used since beginning of the 2000s, https://en.wikipedia.org/wiki/Honeytoken https://en.wikipedia.org/wiki/Honeytoken. I
by pelasaco 4y ago
Well to be honest Honey Tokens is being used since beginning of the 2000s, https://en.wikipedia.org/wiki/Honeytoken https://en.wikipedia.org/wiki/Honeytoken. I personally implemented them in a Bank, 20 years ago, generating some fake credit cards number (and other information) and having them being monitored in AV, IDS, IPS, Antifraud solutions like browser extensions, google search and etc.. So maybe we can say that I'm a random infosec nerd, but i guess, I'm not the only one, just that people and companies preferred to make it in silence, to actually catch the bad guys out there. We actually were able to catch internal people selling data and we could understand some ways data used to flow and work pretty tight with the Police to intercept and bust criminal groups.
- 411111111111111 4y agoYeah, trust self important HN commentators like myself248 to imply incompetence throughout an entire industry while being completely ignorant about said industry.
- pelasaco 4y agopeople normally imagine that finance and specially banks, are just COBOL, mainframe and legacy, and even though it is part of their BAU, there are lot of innovation there, specially in the infosec/antifraud segments.
- myself248 4y agoHow would the operator of an ecommerce website have gotten their hands on these things to seed their data with them? Is this something they would've known to ask for?
- pelasaco 4y agoSo either you generate some fake but valid credit card numbers (i.e with credit card number generator) and set some monitoring on them or even better, you generate a credit card number with something like revolut, and as soon you get some transaction on that number, you know your database was leaked.. not hard actually to setup something like that.