Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub commit search: “remove password”

github.com

Post reply on HN
Print view View original

161–170 of 266 posts

Re: GitHub commit search: “remove password”

#161

Post by Keverw »

wybiral wrote: post #154

A while ago I discovered similarly that there are several searches which lead you to active database logins. https://github.com/search?&q=mysqli_connect+http&type=Code https://github.com/search?q="rds.amazonaws.com"&type=Code etc...

Wow. People would really store production passwords on GitHub for everyone to see?

I wonder if GitHub blocked those searches "We could not perform this search Must include at least one user, organization, or repository"

Edit: If I click on PHP for the language in the sidebar they show up. But hmm, I wonder if maybe GitHub tries to block leaks like that from being searched.

Re: GitHub commit search: “remove password”

#162

Post by wybiral »

Keverw wrote: post #161
wybiral wrote: post #154

A while ago I discovered similarly that there are several searches which lead you to active database logins. https://github.com/search?&q=mysqli_connect+http&type=Code https://github.com/search?q="rds.amazonaws.com"&type=Code etc...

Wow. People would really store production passwords on GitHub for everyone to see? I wonder if GitHub blocked those searches "We could not perform this search Must include at least one user, organization, or repository" Edit: If I click on PHP for the language in the sidebar they show up. But hmm, I wonder if maybe GitHub tries to block leaks like that from being searched.

Yeah, I just started getting those too. But adding "&p=2" to the URL shows results for the next page...

shrug

Re: GitHub commit search: “remove password”

#163

Post by arjie »

manarth wrote: post #139
lutefisk wrote: post #111

Earlier quoted context omitted.

At my work one of my coworkers accidentally put a secret token in a GitHub issue. Couple hours later he got an email from the sysadmin at the parent company saying his token finding script went off. He probably wouldn't have noticed for a long while if that script wasn't running.

Wouldn't the token-finding script be even more of a risk? If the token is XYZ and the script is searching https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&... : 1. It's sharing the token with GitHub. 2. It's embedding the token as query-string parameter in a GET request, which is much more likely to be logged (than sending it as data in a POST request), and more likely to be available to less-privileged/le…

You just search that some token was uploaded by your people, not specifically yours.

Re: GitHub commit search: “remove password”

#165

Post by tetrep »

olegkikin wrote: post #149
jvehent wrote: post #136

Too many comments here recommend to clean up the commit and just hide the mistake under the rug. This is wrong. If you leak a password to any public location, there is only one reasonable course of action: CHANGE IT! Don't even bother rewriting the commit. Focus on changing that password right away, and while you're at it, figure out a better way to manage your secrets outside of your source code in the future. Mista…

But what if your codebase is used in thousands of places that you don't control? You can't always change it. The real lesson is - don't put passwords in your code.

Don't use passwords/secrets/credentials that you can't rotate. If you've created a product in such a way that you can't rotate secrets, you have a large security issue that you should fix ASAP.

It's like someone responding to the suggestion to "use strong/unique passwords" with "but what if I don't have any authentication?"

Re: GitHub commit search: “remove password”

#166

Post by problems »

wybiral wrote: post #162
Keverw wrote: post #161

Earlier quoted context omitted.

Wow. People would really store production passwords on GitHub for everyone to see? I wonder if GitHub blocked those searches "We could not perform this search Must include at least one user, organization, or repository" Edit: If I click on PHP for the language in the sidebar they show up. But hmm, I wonder if maybe GitHub tries to block leaks like that from being searched.

Yeah, I just started getting those too. But adding "&p=2" to the URL shows results for the next page... shrug

You could probably also just use Google to find them with site:github.com.

Re: GitHub commit search: “remove password”

#168

Post by Keverw »

manarth wrote: post #139
lutefisk wrote: post #111

Earlier quoted context omitted.

At my work one of my coworkers accidentally put a secret token in a GitHub issue. Couple hours later he got an email from the sysadmin at the parent company saying his token finding script went off. He probably wouldn't have noticed for a long while if that script wasn't running.

Wouldn't the token-finding script be even more of a risk? If the token is XYZ and the script is searching https://github.com/search?utf8=%E2%9C%93&q=XYZ&type=Commits&... : 1. It's sharing the token with GitHub. 2. It's embedding the token as query-string parameter in a GET request, which is much more likely to be logged (than sending it as data in a POST request), and more likely to be available to less-privileged/le…

Maybe they search the tokens public key and not the token itself. Then if the public key is found, then they download the repo and do scanning for the private key.

Re: GitHub commit search: “remove password”

#169

Post by ecnahc515 »

libeclipse wrote: post #145
plasticbugs wrote: post #142

Earlier quoted context omitted.

I once pushed my Amazon S3 key to GitHub accidentally. Realized instantly what I'd done, and while in the process of feverishly regenerating a new key, my cell phone rings. It's Amazon telling me I pushed my S3 key to GH.

Whoa, that's actually amazing. Wonder how they got alerted and reacted so fast.

It's cheaper for them to give a few engineers a web crawler project that's this specific than it is to refund people. Im just surprised they don't have an "auto revoke access key if found on interwebz" setting in the AWS account settings actually.
Post reply on HN