Canarytokens: Honeypot for critical credentials, get notified when they are used (2015) - https://news.ycombinator.com/item?id=41107209 - July 2024 (42 comments)
Canary Tokens - https://news.ycombinator.com/item?id=34157751 - Dec 2022 (59 comments)
A “Safety Net” for AWS Canarytokens - https://news.ycombinator.com/item?id=33644351 - Nov 2022 (1 comment)
Canarytokens - https://news.ycombinator.com/item?id=31914078 - June 2022 (3 comments)
An insanely easy-to-use honeypot solution that deploys in just four minutes - https://news.ycombinator.com/item?id=30374561 - Feb 2022 (4 comments)
Canarytokens – honeypot tokens that tell you when someone used them - https://news.ycombinator.com/item?id=15778011 - Nov 2017 (1 comment)
You might find some recent work we did on agent deception interesting as well: https://blog.thinkst.com/2026/09/getting-agents-to-tell-on-t...
I feel like a self-hosted version would be better though. Having to phone home to their servers could give the game away.
I'm kinda surprised that they haven't expanded beyond their existing token providers.
If by "fake" you mean ones that pass number validation on web sites, that's easy. I wrote python code to check and generate valid numbers back in the '90s; it's a simple, well known check digit algorithm appended at the end. https://en.wikipedia.org/wiki/Luhn_algorithm.
Also what service do you use to mint endless virtual cc numbers?
We’re using Airwallex now. They’ve been great.
You can read more about the implementation in our blogpost: https://blog.thinkst.com/2024/12/its-baaack-credit-card-cana...
Why is this a given? This service has been around for longer than LLMs have been a thing.
- No LLMs
- LLMs as tools
- LLMs decided some things
- YOLO vibecoded
blog posts date back to at least 2015: https://leonjza.github.io/blog/2015/09/10/canarytokens---the...
I've been using it since 2015