YHacker Newsscreenshots

Screenshot of canarytokens.org: Canary Tokens

First screen, captured 4 days ago.

Canary Tokens

More from canarytokens.org →

Canarytokens.org home page, a free Thinkst service for creating tripwire tokens (URLs, DNS, AWS keys, documents, etc.) that alert you when an attacker touches them.

What HN thinks

Someone called a decade-old honeypot 'vibecoded' and the old guard arrived with receipts from 2015.

Great defense against AI agents
Commenters say canary tokens work especially well against LLM-driven attacks, since agents grab credentials without much discernment.
Not vibecoded, been around forever
Several longtime users pushed back on the claim the service was vibecoded, pointing to use and blog posts going back to 2015.
How the tokens actually work
Discussion covered self-hosting to avoid phoning home, why new API key types are hard to add, and how the credit card tokens are real virtual cards issued through Airwallex.

Consensus: Most commenters think Canarytokens is a useful, long-established tool. The maintainers explained that adding new key types depends on providers offering cheap key minting, defanging and real-time audit logs.

Recommended in the comments

Canarytokens ↗ (tool): It can be self-hosted so alerts don't go through a third-party server.
Stripe Issuing ↗ (service): Given as an example of a service that can mint card numbers from code.
Airwallex (service): The Canarytokens maintainers use it to issue credit card canaries and said it has worked well.

Summarised by Claude from the comment thread 3 days ago.

Points: 124
Comments: 23
Best rank: #13
Posted: 2026-10-21 by wiradikusuma
Category: Security

canarytokens honeytokens intrusion-detection thinkst deception-technology

All captures:

Full page

Full-page screenshot of canarytokens.org

Captured 4 days ago. Click for the whole screenshot.

Looks similar

Screenshot of canarytokens.org: Canarytokens: Honeypot for critical credentials, get notified when they are used (2015)

Canarytokens: Honeypot for critical credentials, get notified when they are used (2015)(canarytokens.org)

126 points by Kovah 2 years ago | 38 comments

Screenshot of github.com: Show HN: Open-source API Key server written in Go by Ory

Show HN: Open-source API Key server written in Go by Ory (github.com)

21 points by leetvibecoder 4 months ago | 3 comments

Screenshot of hashmap.me: Show HN: Hashmap.me – Simple HTTP-Based Data Storage and Retrieval

Show HN: Hashmap.me – Simple HTTP-Based Data Storage and Retrieval (hashmap.me)

33 points by MrRowTheBoat 2 years ago | 22 comments

Screenshot of opendev.org: OpenDev is a collaboratory for open source software development at scale

OpenDev is a collaboratory for open source software development at scale (opendev.org)

92 points by xo5vik 2 years ago | 16 comments

Screenshot of platform.openai.com: OpenAI Tokenizer

OpenAI Tokenizer (platform.openai.com)

289 points by tosh 3 years ago | 152 comments

Screenshot of openapistack.co: Show HN: REST Alternative to GraphQL and tRPC

Show HN: REST Alternative to GraphQL and tRPC (openapistack.co)

106 points by anttiviljami 3 years ago | 61 comments

Related stories

Screenshot of bunny.net: We’re making Bunny DNS free

We’re making Bunny DNS free (bunny.net)

856 points by dabinat 4 months ago | 256 comments

Bunny.net blog post announcing that its Bunny DNS service is becoming free.

bunny-net dns cdn pricing

Screenshot of wiz.io: Gheist campaign plants secret-dumping workflows using stolen GitHub tokens

Gheist campaign plants secret-dumping workflows using stolen GitHub tokens (wiz.io)

44 points by acossta 19 hours ago | 0 comments

Wiz Research blog post analyzing Gheist, a campaign using stolen GitHub tokens to plant workflows that dump repository secrets, with IOCs and response guidance.

github-actions supply-chain-security secrets-exfiltration github-tokens

Screenshot of github.com: OpenTF is now OpenTofu

OpenTF is now OpenTofu (github.com)

352 points by zoidb 3 years ago | 197 comments

GitHub page for the OpenTofu organization, the open source Terraform fork formerly called OpenTF, which urges HashiCorp to return Terraform to an open license.

opentofu terraform hashicorp infrastructure-as-code

Screenshot of skip.dev: Skip is now free and open source

Skip is now free and open source (skip.dev)

482 points by dayanruben 9 months ago | 217 comments

Blog post announcing that Skip, a tool for building iOS and Android apps from a single Swift and SwiftUI codebase, is now free and open source.

skip swift swiftui android

Screenshot of digicert.com: TLS certificate lifetimes will officially reduce to 47 days

TLS certificate lifetimes will officially reduce to 47 days (digicert.com)

485 points by crtasm 1 year ago | 586 comments

DigiCert blog post announcing that the CA/Browser Forum voted to reduce maximum TLS certificate lifetimes to 47 days.

tls-certificates ca-browser-forum pki digicert

Screenshot of Hacker News post: Ask HN: Share your personal website

Ask HN: Share your personal website

842 points by susam 9 months ago | 2217 comments

An Ask HN thread inviting users to share their personal websites for a community-maintained directory hosted at hnpwd.github.io.

personal-websites ask-hn indie-web directory