Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub commit search: “remove password”

github.com

Post reply on HN
Print view View original

151–160 of 266 posts

Re: GitHub commit search: “remove password”

#151

Post by brettdong »

jvehent wrote: post #136

Too many comments here recommend to clean up the commit and just hide the mistake under the rug. This is wrong. If you leak a password to any public location, there is only one reasonable course of action: CHANGE IT! Don't even bother rewriting the commit. Focus on changing that password right away, and while you're at it, figure out a better way to manage your secrets outside of your source code in the future. Mista…

Completely agree. There are forks, mirrors and crawlers on GitHub, even you rewrite the commit and force push to GitHub server, the original commit data still exists in the forks and mirrors, and in fact anyone can even view the original commit in your own repo if they know its commit hash.

Re: GitHub commit search: “remove password”

#152

Post by aequitas »

drinchev wrote: post #26

How do you guys, handle this problem? I use either `git-crypt` [1] or `ansible-vault` [2]. 1: https://github.com/AGWA/git-crypt 2: http://docs.ansible.com/ansible/playbooks_vault.html

For puppet users: https://github.com/TomPoulton/hiera-eyaml

Advantage of this approach is it encrypts the values individually instead of per file. This way the secrets files are git/review friendly.

Re: GitHub commit search: “remove password”

#153

Post by olegkikin »

josscrowcroft wrote: post #96

I liked this one: https://github.com/squared-one/omniauth-unsplash/commit/072b... "... It's not really removing any password, is it? But hey, why not use the momentum ... wheeeeeeeeeeeeeeeeee!"

    -    protected $password = '12root34';
    +    protected $password = '';
"I'm a bit disappointed now that putting 'protected' in front of the password doesn't protect it ;)"

Re: GitHub commit search: “remove password”

#155

Post by jsjohnst »

libeclipse wrote: post #145
plasticbugs wrote: post #142

Earlier quoted context omitted.

I once pushed my Amazon S3 key to GitHub accidentally. Realized instantly what I'd done, and while in the process of feverishly regenerating a new key, my cell phone rings. It's Amazon telling me I pushed my S3 key to GH.

Whoa, that's actually amazing. Wonder how they got alerted and reacted so fast.

I heard AWS has a crawler for that specifically. Not sure if it's true, but makes sense based on the anecdata.

Re: GitHub commit search: “remove password”

#156

Post by chmike »

jvehent wrote: post #136

Too many comments here recommend to clean up the commit and just hide the mistake under the rug. This is wrong. If you leak a password to any public location, there is only one reasonable course of action: CHANGE IT! Don't even bother rewriting the commit. Focus on changing that password right away, and while you're at it, figure out a better way to manage your secrets outside of your source code in the future. Mista…

the solution is to store the password and any other sensitive information in a text file that you read when your program starts up. And don't forget to add that file's name to .gitignore so git will ignore it. As simple as that. :)

If you leaked the password in the git repository, change it as @jvehent just commented.

Re: GitHub commit search: “remove password”

#157

Post by tuxxy »

aaron695 wrote: post #67
s_kilk wrote: post #57

Earlier quoted context omitted.

How would git know that it's a password/key/whatever?

Key is easy. The high entropy should tip you off. Passwords, look for variables with the name password, passwd assigned strings. Like Gmails attachment, it'll get stuff wrong, just make it easy to continue on.

This. However, it would only work with secure passwords. Setting the entropy count too low would result in a bunch of false positives.

Re: GitHub commit search: “remove password”

#158

Post by vbezhenar »

olegkikin wrote: post #149
jvehent wrote: post #136

Too many comments here recommend to clean up the commit and just hide the mistake under the rug. This is wrong. If you leak a password to any public location, there is only one reasonable course of action: CHANGE IT! Don't even bother rewriting the commit. Focus on changing that password right away, and while you're at it, figure out a better way to manage your secrets outside of your source code in the future. Mista…

But what if your codebase is used in thousands of places that you don't control? You can't always change it. The real lesson is - don't put passwords in your code.

Using the same password in thounsands of places isn't good either. Use unique random passwords.

Re: GitHub commit search: “remove password”

#159

Post by lholden »

jvehent wrote: post #136

Too many comments here recommend to clean up the commit and just hide the mistake under the rug. This is wrong. If you leak a password to any public location, there is only one reasonable course of action: CHANGE IT! Don't even bother rewriting the commit. Focus on changing that password right away, and while you're at it, figure out a better way to manage your secrets outside of your source code in the future. Mista…

Very much this.

The first thing you should be doing is making the password useless by changing it. Doing anything else is entirely irresponsible. Sure, remove the file in question after that... but you can't treat the old password as anything other than public knowledge at that point.

Post reply on HN