Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: GitMonKey – monitor your repos and commits for exposed private keys

gitmonkey.io

Post reply on HN
Print view View original

31–40 of 50 posts

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#31

Post by reddytowns »

I was thinking of another strategy could be a git plugin that had a config file of salted hashed secrets. If someone tried to commit something with a secret, it could then stop it before it was leaked.

Of course, you'd need to collect all the secrets beforehand, but if you are willing to do that, it would seem to be a better solution.

I was thinking this and later I fell asleep and had this dream, where my girlfriend kept saying, "Hey... Hey... Hey..." over and over again. I woke up and it turns out there was a bird chirping every few seconds at the same interval.

Time is strange, though. I saw a star trek episode recently where there was time dilation on this particular planet. They were trying to beam out the occupants. It got me thinking, if I could beam out to a spaceship where, say every second on the spaceship was a year on planet earth, would I do it? I have this vague feeling of regret, like I'm missing all those moments on between on Earth while I'm there. I suppose I'd experience the same number of moments, spread out as they were, though.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#32

Post by yeukhon »

antaviana wrote: post #20
nailer wrote: post #9

Weirdly AWS and GitHub seems to have something similar. I know a couple of folks (not me!) who've uploaded AWS credentials to OSS projects on GitHub and been contacted by AWS about it, after AWS has revoked the credentials.

For AWS it makes sense, because typically AWS discounts the customer the damage made by stolen credentials. For example, if a dozen EC2 instances are launched with credentials poached from Github to mine bitcoins, I know AWS used to remove the rogue extra charge from the customer bill, as a token of gratitude (to avoid losing the customer by a sense of defenselessness).

Yes. AWS actually does scan on a regular basis. They have caught some before any harms done. I don't know how often though.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#33

Post by yeukhon »

I believe for AWS,. If attacker gains your key and generated a STS session key, it used to you can't revoke them (that is revoking me does not revoke the key I generate from STS)z i don't know if they fixed it or not, I did a test after someone spoke to me about a year ago.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#34

Post by mynameisvlad »

kierenj wrote: post #11

Before I allow this read access to all of my code, what kind of checks should I run through on GitMonKey as an organisation/product? Edit: when I try to go back to the homepage from the "Install GitHub Integration" page, I'm redirected back. Probably just paranoia.. but still. I want to learn more about the people behind this before clicking this button. Edit 2: no Twitter, no incorporated entity, no names of the peo…

You wouldn't revoke its access on their end, you'd do it on GitHub's end: https://github.com/settings/applications

Otherwise, GH would still have the approval on file (there's no way for them to know you deauthorized on the GitMonkey side) so they'd instantly be able to get a token again.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#35

Post by CGamesPlay »

fredley wrote: post #21
shaharsol wrote: post #14

Earlier quoted context omitted.

If GitMonkey has your key on record - it means we're not the only ones having it. You should revoke it immediately. So even if our db is breached, it should only contain a list of useless revoked keys.

> should

If you signed up for a service specifically to detect when you compromise your secrets, and the service tells you about it, and you don't change the secret... Why are you then worried that the other party gets compromised?

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#38

Post by SmellTheGlove »

One more: I added a repo that I know had some keys in it, and GitMonkey didn't find them. Here's the specifics:

I originally made a bunch of commits that included my config.py file. I realized later that I didn't want that public, so I added it to the ignore and had git remove it. However, if you look through my commit history, you can still see the config.py changes in earlier commits and the keys are buried in there. Since I was/am a git noob, I didn't create branches for those commits. They all went to master, so they're in the commit history of the master branch.

I'm guessing this tool is scanning the branches themselves, but you may want to scan the commit history within those branches if GitHub will let you. Idiots like me that don't know how to use Git properly are probably the ones more likely to make this mistake!

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#40

Post by avh02 »

http://pre-commit.com/hooks.html

calling attention to detect-private-key and detect-aws-credentials (disclaimer-ish: was original contributor on the latter hook but been way expanded since then)

edit: obviously each dev needs to have this set up, not a catch-all third party tool.

Post reply on HN