GitHub commit search: “remove password” • Hacker News Board

Re: GitHub commit search: “remove password”

#11

Post by dorianm » Wed, Feb 15, 2017, 10:36 AM UTC

karrotwaltz wrote: post #8

Related topic: "Production AWS keys on GitHub" ~ 3 years ago https://news.ycombinator.com/item?id=7411927 By just looking quickly, it seems that you can still find many recent live keys...

Amazon scans GitHub and revokes valid keys (can't find source, but proof is that it's been a while no AWS keys were stolen from GitHub)

Re: GitHub commit search: “remove password”

#12

Post by jamesphillips » Wed, Feb 15, 2017, 10:37 AM UTC

Once it's on the internet. Sites like github have become an amazing OSINT tool.

Re: GitHub commit search: “remove password”

#13

Post by lucideer » Wed, Feb 15, 2017, 10:38 AM UTC

There are so many of these.

It gets a little scary when it veers from professional security to individual personal privacy https://github.com/search?p=2&q=smtp.gmail.com+pass&ref=sear...

Re: GitHub commit search: “remove password”

#14

Post by timborden » Wed, Feb 15, 2017, 10:38 AM UTC

karrotwaltz wrote: post #10

jcastelein wrote: post #9

Earlier quoted context omitted.

Give "oops" a try

"stuff" isn't far behind

Always been a fan of "fix" ...LOL

Re: GitHub commit search: “remove password”

#15

Post by nickik » Wed, Feb 15, 2017, 10:42 AM UTC

ioquatix wrote: post #4

Git-crypt is your friend!

Cool. I did no know this existed. I did not know that I wanted it. Now I want it.

Re: GitHub commit search: “remove password”

#16

Post by oelmekki » Wed, Feb 15, 2017, 10:42 AM UTC

The worst part in that is that it provides tons of passwords to analyze and detect recurring words or schemes. This probably also will hurt people that never commited their passwords in public repos. Github should probably filter out such searches.

Re: GitHub commit search: “remove password”

#17

Post by sagivo » Wed, Feb 15, 2017, 10:43 AM UTC

git is a great tool, unfortunately there's no standard of storing sensitive info (like passwords). some store it as ENV variables, some hard copy the files to servers using custom scripts etc.. would love to see an easy tool that developers can use to manage this info like people manage files on git.

Re: GitHub commit search: “remove password”

#18

Post by shawabawa3 » Wed, Feb 15, 2017, 10:44 AM UTC

dorianm wrote: post #7

Right after my "remove secrets" post: https://news.ycombinator.com/item?id=13650614 There are just so many of those it's crazy: remove .env YOURFAVORITEAPI_SECRETKEY YOURFAVORITEAPI_PASSWORD Also replace "remove" with delete/rm/replace/etc. And replace "YOURFAVORITEAPI" with CircleCI, Travis, Mailchimp, Trello, Stripe, etc, etc. Also, companies I contacted consider it the customer fault and basically don't care.

It is customer fault.

However it should be pretty easy for them to set up a script to search github for this kind of stuff and automatically invalidate keys

Re: GitHub commit search: “remove password”

#19

Post by dorianm » Wed, Feb 15, 2017, 10:47 AM UTC

shawabawa3 wrote: post #18

dorianm wrote: post #7

Right after my "remove secrets" post: https://news.ycombinator.com/item?id=13650614 There are just so many of those it's crazy: remove .env YOURFAVORITEAPI_SECRETKEY YOURFAVORITEAPI_PASSWORD Also replace "remove" with delete/rm/replace/etc. And replace "YOURFAVORITEAPI" with CircleCI, Travis, Mailchimp, Trello, Stripe, etc, etc. Also, companies I contacted consider it the customer fault and basically don't care.

It is customer fault. However it should be pretty easy for them to set up a script to search github for this kind of stuff and automatically invalidate keys

1) Search for common pattern where the key can be stored

2) Search if found keys are actual valid keys

3) Expire key, send explanatory email, issue new key

(I think that's what AWS does)

Re: GitHub commit search: “remove password”

#20

Post by dorianm » Wed, Feb 15, 2017, 10:49 AM UTC

ioquatix wrote: post #4

Git-crypt is your friend!

Then .gitignore and .env are your best friends :)