Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub commit search: “remove password”

github.com

Post reply on HN
Print view View original

111–120 of 266 posts

Re: GitHub commit search: “remove password”

#111

Post by lutefisk »

shawabawa3 wrote: post #18
dorianm wrote: post #7

Right after my "remove secrets" post: https://news.ycombinator.com/item?id=13650614 There are just so many of those it's crazy: remove .env YOURFAVORITEAPI_SECRETKEY YOURFAVORITEAPI_PASSWORD Also replace "remove" with delete/rm/replace/etc. And replace "YOURFAVORITEAPI" with CircleCI, Travis, Mailchimp, Trello, Stripe, etc, etc. Also, companies I contacted consider it the customer fault and basically don't care.

It is customer fault. However it should be pretty easy for them to set up a script to search github for this kind of stuff and automatically invalidate keys

At my work one of my coworkers accidentally put a secret token in a GitHub issue. Couple hours later he got an email from the sysadmin at the parent company saying his token finding script went off. He probably wouldn't have noticed for a long while if that script wasn't running.

Re: GitHub commit search: “remove password”

#112

Post by beothorn »

sparkslabs wrote: post #56

I'll raise you a handful more: add password / add passwords * https://github.com/search?utf8=%E2%9C%93&q=add+passwords&typ... * https://github.com/search?utf8=%E2%9C%93&q=add+password&type... add secret / add secrets * https://github.com/search?utf8=%E2%9C%93&q=add+secret&type=C... * https://github.com/search?utf8=%E2%9C%93&q=add+secrets&type=...

Also:

search for code making connections to db

ruby https://github.com/search?q=DBI.connect&ref=searchresults&ty...

java https://github.com/search?p=2&q=DriverManager.getConnection%...

and so on...

Re: GitHub commit search: “remove password”

#113

Post by ProblemFactory »

AckSyn wrote: post #99
lucideer wrote: post #13

There are so many of these. It gets a little scary when it veers from professional security to individual personal privacy https://github.com/search?p=2&q=smtp.gmail.com+pass&ref=sear...

I should be amazed at how prevalent this is but after almost two decades in IT/IS, it's no more than the equivalent to the Post-IT on a monitor, but more accessible. Dumb, but business as usual.

> the equivalent to the Post-IT on a monitor

Writing passwords down on a piece of paper, and keeping that in your wallet or locked desk drawer is actually one of the more secure ways of storing passwords these days.

No risk of electronic compromise, and its highly unlikely that people who would steal your wallet or break into your home are also interested in your online accounts.

Re: GitHub commit search: “remove password”

#114

Post by Cyphase »

Klathmon wrote: post #74
chimeracoder wrote: post #60

Earlier quoted context omitted.

Why would you ever want to share a valid Github API key publicly?

It's been a while, but IIRC it was a key with no permissions used on a CI server to get around github's API usage limits. It probably wasn't the best idea, but it was the only "secret" needed in the whole project and I didn't want to maintain a way of managing secrets in a public project for a pointless key. In the end I did just that, and looking back it was the better choice, but at the time it was annoying.

"... used ... to get around github's API usage limits."

I wonder why they'd want to invalidate that. :)

Re: GitHub commit search: “remove password”

#116

Post by jameshart »

raesene6 wrote: post #50
Xylakant wrote: post #38

Earlier quoted context omitted.

On an internal VCS this may be a deliberate decision: Secrets need to be stored somewhere and a cost-risk analysis can result in "this is the best place that we currently have at our disposal". That obviously won't fly if your threat model includes "adversary may attack our github account from within GH" or if you ever plan on opening up that repo, but if neither applies this may be the best place to store some sorts…

Sure there's always a cost / benefit balance to take into account. That said I'd say putting secrets in a git repo is a pretty risky thing to do. By the nature of the tool that means that the secret ends up on the device(s) of every developer who checks out the codebase, so the security of the secrets is equal to the security of the worst secured device in question.

Also, there's a surprising number of websites out there with a .git directory in the root...

Re: GitHub commit search: “remove password”

#118

Post by TeMPOraL »

Klathmon wrote: post #46
_pctq wrote: post #34

Earlier quoted context omitted.

And this would be a cool feature from github too. A link mentioning "we found something in your code that looks like a secret, please know people will use it."

They do this for all of their own API keys already. They not only notify you but instantly invalidate a key pushed to a public repo. Annoyingly there is no way to turn it off even when you explicitly want to share an API key knowingly. But i'm more than fine with needing to "obfuscate" an API key or manage secrets correctly knowing it saves TONS of people.

Split it to parts and concatenate it, then?

$key = "BAAD" + "F00D" + "CAFE" + "BABE";

Re: GitHub commit search: “remove password”

#120

Post by [deleted] »

faitswulff wrote: post #91
therealasdf wrote: post #87

For anyone wondering, if you want to remove a file or secret you've already committed, you can use BFG Repo-Cleaner to go through your commit history and completely remove any trace of it. https://rtyley.github.io/bfg-repo-cleaner/

Just note that if it's a public repo, it may not help you, due to attackers scraping Github's API and mirrors like GHTorrent. From "Why Deleting Sensitive Information from Github Doesn't Save You": http://jordan-wright.com/blog/2014/12/30/why-deleting-sensit... The top HN comment on the article details their experiences with getting hacked this way: https://news.ycombinator.com/item?id=8818035

[deleted]
Post reply on HN