Thinkst Thoughts
blog.thinkst.com · Company blog · on HN since 2010
Thinkst is a security company whose team writes about Canary tokens, breach detection, and security product decisions.
What HN saysCommenters praise Canarytokens, such as the AWS credential token, and cite its post arguing that NSA fiber taps have legal explanations.
39HN people shared it
10linked it in comments
80stories submitted
1.7Kstory points
3 months agolast shared
2010people per year2026
Most-shared posts
- 1Canarytokens.org – Quick, Free, Detection for the Masses11 people · 56 points · first shared 2015 · discussion on HN
- 2NSA Owns Everything (2015)4 people · 366 points · first shared 2015 · 248 comments on HN
- 3Building WireGate: A WireGuard front to detect compromised keys3 people · 11 points · first shared 2021 · discussion on HN
- 4Detect breaches with Canary credit cards3 people · 4 points · first shared 2023 · discussion on HN
- 5We bootstrapped to $11M in ARR2 people · 393 points · first shared 2021 · 217 comments on HN
- 6Unfashionably secure: why we use isolated VMs2 people · 308 points · first shared 2024 · 243 comments on HN
- 7Canarytokens.org – Quick, Free, Detection for the Masses2 people · 10 points · first shared 2015 · 1 comments on HN
- 8Why Pareto optimality might be wrong for building products2 people · 7 points · first shared 2020 · discussion on HN
- 9Penetration Testing Considered Harmful Today2 people · 6 points · first shared 2012 · discussion on HN
- 10Cyberwar: Why your threat model is probably wrong2 people · 5 points · first shared 2010 · 1 comments on HN
- 11As a young security startup, should you have a booth at the RSA Expo?2 people · 5 points · first shared 2018 · discussion on HN
- 12Use Windows signing to get notified on file opens / executions2 people · 4 points · first shared 2016 · discussion on HN
- 13Would you know if your phone was hacked?2 people · 3 points · first shared 2021 · discussion on HN
- 14Use a fake kubeconfig file to detect attackers2 people · 2 points · first shared 2021 · discussion on HN
- 15A Steve Jobs masterclass from a decade ago1 people · 339 points · first shared 2020 · 149 comments on HN
What HN people wrote when they linked it
thinkst · 2024-07-18
The updates in universe are definitely best effort.
We were paying for Ubuntu Pro through an AWS subscription on 2k EC2 instances, and could not get Canonical to update a package with a CVSS 7.8 in the 18.04 LTS.
We've moved off Ubuntu Pro as a result. Blogged it at https://blog.thinkst.com/2024/07/unobtrusively-upgrading-ubuntu-underf…
Corrado · 2022-02-17
I ran across this service while reading a blog post from Corey Quinn about AWS security. It turns out that CanaryTokens has a AWS IAM token generator that alerts whenever someone tries to use it. That's a great idea and I can see sprinkling credentials around would make a great tripwire.
https://blog.thinkst.com/2017/09/canarytokens-new-member-aws-api-key.h…
boomboomsubban · 2021-04-17
Here's an excellent article on the topic, this is a huge uproar on an everyday occurrence.
https://blog.thinkst.com/p/if-nsa-has-been-hacking-everything-how.html
burfog · 2020-08-16
He jumped to a conclusion, not realizing that the NSA had plenty of perfectly legal reasons to have split off copies of backbone fiber trunks.
A great example is point #4, "Some beautiful misdirection", in https://blog.thinkst.com/p/if-nsa-has-been-hacking-everything-how.html discussed 3 days ago at https://news.ycombinator.com/item?id=24139828
That's some ingenious stuff that is 100% legal.
Plus, it's not as if foreign data doesn't cross the USA. The USA is the best path from China to France.
Maybe they'd really prefer to take the public relations hit of everybody thinking that they spy on Americans.
toomuchtodo · 2023-10-23
mmsc · 2023-05-24
This is called a canary and can be used in so many places: https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offen…
kevsim · 2020-07-15
Yeah, I think that's the gist. Fake PoC of a CVE, people ran random code, author caught them in the act via a canary token [0] and rickrolled them.
0: https://blog.thinkst.com/p/canarytokensorg-quick-free-detection.html
guitarbill · 2018-11-30
Something not widely used are canary tokens: https://blog.thinkst.com/p/canarytokensorg-quick-free-detection.html
The general idea is to insert some kind of bogus information into a system, with no links to other systems, and then trigger a notification if someone accesses it.
mh_ · 2012-07-07
Agree 100%. In fact in 2010 I wrote a post titled:Cargo Cult startups on exactly this: http://blog.thinkst.com/2010/04/cargo-cult-startups.html
thaumaturgy · 2020-05-15
Cool, thanks. I found https://blog.thinkst.com/p/canarytokensorg-quick-free-detection.html; is there a better writeup you have offhand? https://github.com/cowrie/cowrie has been on my todo list for a while too, but more as a toy than a serious thing.
> The networks I'm describing aren't "ideal" or "highly secured". I am describing table stakes. While I was at Latacora, most of the clients we engaged with were already at this level of maturity when we joined up.
One of the most valuable things you do here is describe things that you believe are table stakes to people and organizations that have never heard of them. Companies like Latacora tend to self-select for clients that are at least aware that security should be a sensible line item in their quarterly budget. There are many many more organizations for whom moving ssh or even port knocking amount to a real improvement to their infrastructure. :-(