6 ms·
Want to know how I detect suspicious activity in my password manager? I have a plaintext bitcoin private key in my password manager as a note. The name is 'bitc
by AustinDev 3y ago
Want to know how I detect suspicious activity in my password manager? I have a plaintext bitcoin private key in my password manager as a note. The name is 'bitcoin wallet'. It contains 0.5 BTC. If my password manager ever get compromised, I can reasonably expect the bitcoins to be move from that wallet address.
I then have a BTC node that will send me an SMS if those coins ever move.
- noknownsender 3y agoIsn't that potentially a $15k detection method?
- altairprime 3y agoMore like $8k net after taxes, anyways.
- drexlspivey 3y agoDoesn't the US have a tax free allowance for capital gains? In the UK for example you get a 15k allowance annualy
- latchkey 3y agoUS military is quite impressive.
- dtgriscom 3y agoThat needs to be weighed against the likelihood of a compromise (probably low), and the cost of such a compromise (probably quite a bit higher than $15k).
- sprawl_ 3y ago> 0.5 BTC That's one expensive alert.
- AustinDev 3y agoThe passwords in my manager could potentially cause more financial harm than 0.5 BTC going missing. Everyone has their own price for security. I've also not moved those BTC since 2014 so the price has appreciated considerably.
- jtriangle 3y agoThe point is that there are far cheaper canaries to keep in your coalmine.
- blantonl 3y agoMore succinctly, this is plain dumb. And especially to tell people about it in public.
- gerdesj 3y agoNo it really isn't dumb at all. Its the basis of a "honeypot". Museums and galleries etc put their wares on show in public - can you be sure that what is shown is what you think it is or secured as you think it is? Please don't describe anyone as dumb - its as much demeaning to you as it is anyone else.
- ziddoap 3y agoHigh value passwords doesn't mean you need a 0.5 BTC alerting method, though? You just went from "significant financial harm" to "significant financial harm, and 0.5 BTC".
- AustinDev 3y agoThe idea is anyone who compromised my password manager would likely go for the wallet first since it's as good as cold hard cash. Using the private keys and other secrets stored in my manager would take much more time for an attacker to exact meaningful value. I would expect the BTC to be moved first and foremost which would hopefully give me enough time to mitigate any other damage that could be caused by the content of my password manager being exposed.
- toomuchtodo 3y agohttps://blog.thinkst.com/2023/01/swipe-right-on-our-new-credit-card-tokens.html https://blog.thinkst.com/2023/01/swipe-right-on-our-new-cred... https://canarytokens.org/ https://canarytokens.org/ https://news.ycombinator.com/item?id=34476507 https://news.ycombinator.com/item?id=34476507
- ziddoap 3y agoThat sounds like an expensive notification system.
- barbazoo 3y agoIs that a $15k circuit breaker?
- conroydave 3y agowould be just as effective with .05 btc
- paulpauper 3y agoyeah, that is a lot of money in a developing country
- Nextgrid 3y agoDebatable - the objective is to play on an attacker's greed and convince them to go for the BTC before any other credentials. Too low of an amount and the other credentials in there might start to look more interesting.
- M3L0NM4N 3y agoUnless you're being specifically targeted because you're a high up position (ex. CEO) I'd imagine .05 BTC is plenty to attract the attention.
- nopurpose 3y agowhat's your plan if you receive that SMS?
- solardev 3y agoChange the password to the account that has 5 BTC?
- KomoD 3y agoI just have a canarytokens credit card stored in it, if anyone tries to auth it I get an alert
- mtmail 3y agoThat looks like a great approach indeed. https://www.canarytokens.org/generate https://www.canarytokens.org/generate
- blantonl 3y agoYeah, I like to leave my Rolex Rose Gold GMT out on my nightstand when service people are working in the house to detect suspicious activity in my household. :/ Sorry man, I dunno if this is a weird flex or what, but it's kind of ridiculous to leave $15K of bitcoin as a canary for your password manager. Gotta call a spade a spade.
- paulpauper 3y agoYeah, I like to leave my Rolex Rose Gold GMT out on my nightstand when service people are working in the house to detect suspicious activity in my household. :/ i don't think that is a bad idea . It can be a cheaper one or a replica. The idea is it's a small price to pay when being deceived costs far more
- Nextgrid 3y agoIt all depends on how costly the fallout from a compromised password manager would be - 15k can be totally reasonable insurance policy if the other credentials in there could give them access to multiples of that?
- cogman10 3y agoWhy do 15 when $100, $250, or $1k would do the same trick?
- spacebanana7 3y agoAssuming the bitcoin is held as an ‘investment’ anyway, is it really that much worse for it to held on a password manager as opposed to an exchange?
- stuckkeys 3y agoI think he is being sarcastic. Emphasis on the “I think” part.
- paulpauper 3y agoOne should always use caution when using password managers with anything crpyto related.
- eigenvalue 3y agoSounds like a great idea for a service that manages this automatically for users (but using a more reasonable amount of BTC, like 0.01 BTC or ~$300 worth-- it has to be enough to be worth stealing I suppose!). Then it would automatically do the monitoring of that address and send the user the alert that they should change all their passwords when the coins move. If it happens to just that one account, then its likely the user's account was hacked. If it happens to a bunch of accounts at the same time, it's more likely that the password manager service was hacked. Like a canary with a bounty attached to it.
- nvy 3y agoThis exact service exists, and has been featured on HN at least once!
- sigmar 3y agoJust spitballing on the idea of this being a service- Wonder if it would work for the canary-creator to also have a bot that watches the btc mem pool, and if it sees the .5 btc from this address being spent, it front-runs it with a transactions that has a much high transaction fee and directs the funds to a new safe wallet. Probably some risk of the bot failing to front-run, but otherwise it would have all the benefits of a $15k canary without the downside of losing all of the money.
- eigenvalue 3y agoInteresting idea. Would also be cool to try to trace back the IP of the first node that announced the transaction to the network so you could try to figure out who the thief is (assuming they aren't using a VPN).
- yieldcrv 3y agoa cheaper way would be to have a highly valuable token in the address without any of the chain’s native asset to pay for moving it then just alert yourself when the native asset is moved to that address, because then someone is trying to sweep. your node can also send some some of the same asset faster at a higher transaction fee and move all of your tokens somewhere safe people already do this mostly as a scam to take the tiny amount of funds that thieves send to try to move the more lucrative bounty you can take this one step further and have many assets worth sweeping, including assets that merely look like lucrative tokens. one of those is backdoored so that the transfer() function is nonstandard and transfers all the assets out of the attackers address when they try to move yours. or you can at least get just your own assets back if you want to be morally superior, moved to a safe address. this wont work if they dont take your backdoored token though. but all other parts about intercepting your assets before accepted into a block still would.
- lijok 3y agoI don’t know if you though about this but the first thing a hacker would do after gaining access to your 1password vault is export all data. Why not fill the vault with canary accounts and tokens instead? There’s services that do it for you.