GitHub commit search: “remove password” • Hacker News Board

Re: GitHub commit search: “remove password”

#21

Post by Flimm » Wed, Feb 15, 2017, 10:49 AM UTC

shawabawa3 wrote: post #18

dorianm wrote: post #7

Right after my "remove secrets" post: https://news.ycombinator.com/item?id=13650614 There are just so many of those it's crazy: remove .env YOURFAVORITEAPI_SECRETKEY YOURFAVORITEAPI_PASSWORD Also replace "remove" with delete/rm/replace/etc. And replace "YOURFAVORITEAPI" with CircleCI, Travis, Mailchimp, Trello, Stripe, etc, etc. Also, companies I contacted consider it the customer fault and basically don't care.

It is customer fault. However it should be pretty easy for them to set up a script to search github for this kind of stuff and automatically invalidate keys

Heroku's official Python template include `.env` in the repo: https://github.com/heroku/python-getting-started https://github.com/heroku/heroku-django-template (Although, to be fair, they do include `.env` in the `.gitignore` file.)

Re: GitHub commit search: “remove password”

#22

Post by raesene6 » Wed, Feb 15, 2017, 10:50 AM UTC

This is a good example of the increased risks from doing your development out in the open, any mistakes are exposed to a much wider group of potential adversaries.

On an internal VCS, this would still be a problem, but a bit less visible/exploitable...

Re: GitHub commit search: “remove password”

#23

Post by LeonidBugaev » Wed, Feb 15, 2017, 10:52 AM UTC

If you found a similar mistake in your repository, you can delete commit from history using: `git rebase --onto ^ `. Or if you want actually rewrite it, see git rebase -i` documentation.

Re: GitHub commit search: “remove password”

#24

Post by raesene6 » Wed, Feb 15, 2017, 10:54 AM UTC

oelmekki wrote: post #16

The worst part in that is that it provides tons of passwords to analyze and detect recurring words or schemes. This probably also will hurt people that never commited their passwords in public repos. Github should probably filter out such searches.

I think the ship of "easily analzed password dumps" has already sailed e.g. https://xato.net/today-i-am-releasing-ten-million-passwords-... <-- 10 million passwords

Re: GitHub commit search: “remove password”

#25

Post by microtonal » Wed, Feb 15, 2017, 10:54 AM UTC

LeonidBugaev wrote: post #23

If you found a similar mistake in your repository, you can delete commit from history using: `git rebase --onto ^ `. Or if you want actually rewrite it, see git rebase -i` documentation.

Doesn't that requires a force push? Force pushes are acceptable for private repositories with a single user, but typically not in larger projects.

Just revoke the password/secret/whatever.

Re: GitHub commit search: “remove password”

#26

Post by drinchev » Wed, Feb 15, 2017, 10:55 AM UTC

How do you guys, handle this problem?

I use either `git-crypt` [1] or `ansible-vault` [2].

1: https://github.com/AGWA/git-crypt

2: http://docs.ansible.com/ansible/playbooks_vault.html

Re: GitHub commit search: “remove password”

#27

Post by sirn » Wed, Feb 15, 2017, 10:57 AM UTC

Searching filename:id_rsa also yield a rather interesting result. Alongside with "BEGIN OPENSSH PRIVATE KEY". I wonder how much of these also contains ssh_config.

Re: GitHub commit search: “remove password”

#28

Post by FanaHOVA » Wed, Feb 15, 2017, 10:57 AM UTC

drinchev wrote: post #26

How do you guys, handle this problem? I use either `git-crypt` [1] or `ansible-vault` [2]. 1: https://github.com/AGWA/git-crypt 2: http://docs.ansible.com/ansible/playbooks_vault.html

ENV variables. I use `dotenv` in Ruby projects.

Re: GitHub commit search: “remove password”

#29

Post by oelmekki » Wed, Feb 15, 2017, 10:57 AM UTC

raesene6 wrote: post #24

oelmekki wrote: post #16

The worst part in that is that it provides tons of passwords to analyze and detect recurring words or schemes. This probably also will hurt people that never commited their passwords in public repos. Github should probably filter out such searches.

I think the ship of "easily analzed password dumps" has already sailed e.g. https://xato.net/today-i-am-releasing-ten-million-passwords-... <-- 10 million passwords

Yeah, indeed. I guess we can expect password schemes to change over time, so it's still a good idea to prevent it. Not sure in which proportion it helps, though.

Re: GitHub commit search: “remove password”

#30

Post by tinco » Wed, Feb 15, 2017, 11:03 AM UTC

dorianm wrote: post #11

karrotwaltz wrote: post #8

Related topic: "Production AWS keys on GitHub" ~ 3 years ago https://news.ycombinator.com/item?id=7411927 By just looking quickly, it seems that you can still find many recent live keys...

Amazon scans GitHub and revokes valid keys (can't find source, but proof is that it's been a while no AWS keys were stolen from GitHub)

I have it on good authority ( >_> ) that this is indeed true.