Honeytoken
Honeytoken
Honeytoken (Köder-Artefakt)
A honeytoken is a deliberately placed digital bait — such as a fake credential file, a decoy data record or a prepared link — that has no legitimate purpose and serves solely to raise an alarm as soon as someone touches it. Every use is by definition suspicious. Honeytokens are the smallest, most elegant form of deception technology.
History & facts. Whereas a honeypot is an entire bait system, a honeytoken is a single bait object: a supposed password in a file, a fake database entry, a document with an embedded call-back signal, an API key that was never real. The principle became known, among other things, through the freely usable „Canarytokens“ by Thinkst. The appeal lies in the asymmetry: the effort is minimal, the informational value maximal — because a legitimate user has no reason to touch the object.
Outlook & recommendation. Honeytokens are excellently suited to exposing attackers who have already gained access and are searching for loot — such as credentials in files. Well scattered across file stores, code repositories and databases, they provide an early, high-quality, low-false-positive signal. They complement honeypots (see T-Pot — The All-In-One Multi Honeypot Platform (T-Pot), Cowrie SSH/Telnet Honeypot (Cowrie), OpenCanary) and fit into any detection strategy because they react not to signatures but to illegitimate access.