GitHub commit search: “remove password”

Post by lutefisk » Wed, Feb 15, 2017, 2:37 PM UTC

manarth wrote: post #139

lutefisk wrote: post #111

Earlier quoted context omitted.

At my work one of my coworkers accidentally put a secret token in a GitHub issue. Couple hours later he got an email from the sysadmin at the parent company saying his token finding script went off. He probably wouldn't have noticed for a long while if that script wasn't running.

Wouldn't the token-finding script be even more of a risk? If the token is XYZ and the script is searching https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&... : 1. It's sharing the token with GitHub. 2. It's embedding the token as query-string parameter in a GET request, which is much more likely to be logged (than sending it as data in a POST request), and more likely to be available to less-privileged/le…

Post by obsurveyor » Wed, Feb 15, 2017, 2:37 PM UTC

manarth wrote: post #139

lutefisk wrote: post #111

Earlier quoted context omitted.

At my work one of my coworkers accidentally put a secret token in a GitHub issue. Couple hours later he got an email from the sysadmin at the parent company saying his token finding script went off. He probably wouldn't have noticed for a long while if that script wasn't running.

Wouldn't the token-finding script be even more of a risk? If the token is XYZ and the script is searching https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&... : 1. It's sharing the token with GitHub. 2. It's embedding the token as query-string parameter in a GET request, which is much more likely to be logged (than sending it as data in a POST request), and more likely to be available to less-privileged/le…

Post by libeclipse » Wed, Feb 15, 2017, 2:39 PM UTC

plasticbugs wrote: post #142

dorianm wrote: post #7

Right after my "remove secrets" post: https://news.ycombinator.com/item?id=13650614 There are just so many of those it's crazy: remove .env YOURFAVORITEAPI_SECRETKEY YOURFAVORITEAPI_PASSWORD Also replace "remove" with delete/rm/replace/etc. And replace "YOURFAVORITEAPI" with CircleCI, Travis, Mailchimp, Trello, Stripe, etc, etc. Also, companies I contacted consider it the customer fault and basically don't care.

I once pushed my Amazon S3 key to GitHub accidentally. Realized instantly what I'd done, and while in the process of feverishly regenerating a new key, my cell phone rings. It's Amazon telling me I pushed my S3 key to GH.

Post by vidyesh » Wed, Feb 15, 2017, 2:43 PM UTC

jvehent wrote: post #132

palerdot wrote: post #131

Just using a random commit name like 'minor bug fix', 'updated version' for these kind of commits will save a lot of headaches like this. One can do better by adding random lines/ logs in lot of files and sneakily remove password from one of them and then give a random commit name. But then it all boils down to your mindset at that particular moment when you are commuting.

> Just using a random commit name like 'minor bug fix', 'updated version' for these kind of commits will save a lot of headaches like this. Just change the leaked passwords, don't try to hide the commits.

Post by olegkikin » Wed, Feb 15, 2017, 2:46 PM UTC

jvehent wrote: post #136

Too many comments here recommend to clean up the commit and just hide the mistake under the rug. This is wrong. If you leak a password to any public location, there is only one reasonable course of action: CHANGE IT! Don't even bother rewriting the commit. Focus on changing that password right away, and while you're at it, figure out a better way to manage your secrets outside of your source code in the future. Mista…