GitHub commit search: “remove password” • Hacker News Board

Re: GitHub commit search: “remove password”

#91

Post by faitswulff » Wed, Feb 15, 2017, 12:50 PM UTC

therealasdf wrote: post #87

For anyone wondering, if you want to remove a file or secret you've already committed, you can use BFG Repo-Cleaner to go through your commit history and completely remove any trace of it. https://rtyley.github.io/bfg-repo-cleaner/

Just note that if it's a public repo, it may not help you, due to attackers scraping Github's API and mirrors like GHTorrent. From "Why Deleting Sensitive Information from Github Doesn't Save You":

http://jordan-wright.com/blog/2014/12/30/why-deleting-sensit...

The top HN comment on the article details their experiences with getting hacked this way:

https://news.ycombinator.com/item?id=8818035

Re: GitHub commit search: “remove password”

#92

Post by martincmartin » Wed, Feb 15, 2017, 12:51 PM UTC

Years ago, there were proggit posts of google searches for open myphpadmin consoles. I think people then went and deleted/messed with the databases. My search fu is failing me though, I can't find any of those threads.

Re: GitHub commit search: “remove password”

#93

Post by hharnisch » Wed, Feb 15, 2017, 12:51 PM UTC

Thank you for highlighting this is a such a common mistake. I hope developers of all skill levels look at this and realize it how easy it is to make this mistake and learn from it.

Re: GitHub commit search: “remove password”

#94

Post by _joel » Wed, Feb 15, 2017, 1:03 PM UTC

Another for the list, JSON or YAML containing 'password' - https://github.com/search?utf8=%E2%9C%93&q=password+extensio...

Reminds me of the eye opening experience available at https://www.exploit-db.com/google-hacking-database/

Re: GitHub commit search: “remove password”

#95

Post by empath75 » Wed, Feb 15, 2017, 1:06 PM UTC

Rotate your keys and passwords in production, everyone.

Re: GitHub commit search: “remove password”

#96

Post by josscrowcroft » Wed, Feb 15, 2017, 1:07 PM UTC

I liked this one:

https://github.com/squared-one/omniauth-unsplash/commit/072b...

"... It's not really removing any password, is it? But hey, why not use the momentum ... wheeeeeeeeeeeeeeeeee!"

Re: GitHub commit search: “remove password”

#97

Post by hackerboos » Wed, Feb 15, 2017, 1:09 PM UTC

sparkslabs wrote: post #56

I'll raise you a handful more: add password / add passwords * https://github.com/search?utf8=%E2%9C%93&q=add+passwords&typ... * https://github.com/search?utf8=%E2%9C%93&q=add+password&type... add secret / add secrets * https://github.com/search?utf8=%E2%9C%93&q=add+secret&type=C... * https://github.com/search?utf8=%E2%9C%93&q=add+secrets&type=...

Some of these commits are PGP signed...

Re: GitHub commit search: “remove password”

#98

Post by pcr0 » Wed, Feb 15, 2017, 1:16 PM UTC

hackerboos wrote: post #97

sparkslabs wrote: post #56

I'll raise you a handful more: add password / add passwords * https://github.com/search?utf8=%E2%9C%93&q=add+passwords&typ... * https://github.com/search?utf8=%E2%9C%93&q=add+password&type... add secret / add secrets * https://github.com/search?utf8=%E2%9C%93&q=add+secret&type=C... * https://github.com/search?utf8=%E2%9C%93&q=add+secrets&type=...

Some of these commits are PGP signed...

What do you mean by that?

That people took the trouble to use PGP but then go and do something this silly?

Re: GitHub commit search: “remove password”

#99

Post by AckSyn » Wed, Feb 15, 2017, 1:19 PM UTC

lucideer wrote: post #13

There are so many of these. It gets a little scary when it veers from professional security to individual personal privacy https://github.com/search?p=2&q=smtp.gmail.com+pass&ref=sear...

I should be amazed at how prevalent this is but after almost two decades in IT/IS, it's no more than the equivalent to the Post-IT on a monitor, but more accessible. Dumb, but business as usual.

Re: GitHub commit search: “remove password”

#100

Post by EJTH » Wed, Feb 15, 2017, 1:22 PM UTC

Almost as many results on 'remove credentials' :-)