Canary Tokens

That’s a really good idea, I love that they even do fake bank cards.

I feel like a self-hosted version would be better though. Having to phone home to their servers could give the game away.

Related. Others?

Canarytokens: Honeypot for critical credentials, get notified when they are used (2015) - https://news.ycombinator.com/item?id=41107209 - July 2024 (42 comments)

Canary Tokens - https://news.ycombinator.com/item?id=34157751 - Dec 2022 (59 comments)

A “Safety Net” for AWS Canarytokens - https://news.ycombinator.com/item?id=33644351 - Nov 2022 (1 comment)

Canarytokens - https://news.ycombinator.com/item?id=31914078 - June 2022 (3 comments)

An insanely easy-to-use honeypot solution that deploys in just four minutes - https://news.ycombinator.com/item?id=30374561 - Feb 2022 (4 comments)

Canarytokens – honeypot tokens that tell you when someone used them - https://news.ycombinator.com/item?id=15778011 - Nov 2017 (1 comment)

I think this service is already pretty good, but when defending against LLM based attacks, they're a godsend. Current tools don't appear to be too discerning.

Any idea on how to roll-your-own canary token for an unsupported token provider like Cloudflare/Stripe/OpenAI? Do you just make a real Cloudflare/Stripe/OpenAI account, create an API key, and vibecode an alerting system?

I'm kinda surprised that they haven't expanded beyond their existing token providers.

They make credit cards. Obviously they're not real cards but what sort of financial wizardry is required to make that possible? And given it's vibecoded that means Claude knows how to make fake credit cards now?