21–30 of 47 posts
There are many people writing automated tools doing their best to catch slip-ups like this before everyone else. Dark Forest and all that.
And as someone else said, why use a wallet holding mainnet private funds as a dev wallet? Separate your keys.
Browser extension maybe? Did you or your partner look at the newly created repo in a browser right after creating it? I could see an extension watching for git like listings with json files named like wallets and fetch()ing them when they appear. Easy enough to recreate, test with the devtools tab open.
Earlier quoted context omitted.
But they shouldn't have access to private repos, right?
I deliberately leave various types of cryptocurrency in 'private' areas of quite a lot of online services, including GitHub. So far, nothing has been taken from GitHub. (It's part of research for my side project serverthiefbait.com)
I thought that at this point it’s common sense that any secret pushed to a public GitHub repo should be considered compromised, regardless of how quick you roll it back. There are many people writing automated tools doing their best to catch slip-ups like this before everyone else. Dark Forest and all that. And as someone else said, why use a wallet holding mainnet private funds as a dev wallet? Separate your keys.
Earlier quoted context omitted.
I deliberately leave various types of cryptocurrency in 'private' areas of quite a lot of online services, including GitHub. So far, nothing has been taken from GitHub. (It's part of research for my side project serverthiefbait.com)
Cool project. If I pay you $900 how much of that goes into cryptocurrency? Seems like you could achieve the same result if you just let your customers buy their own coins and provide an address for you to watch?
I have had troubles with people using the service as a way to get money off stolen credit cards, so the low initial deposit is a way to avoid that.
There is also a lot of per-customer randomness to prevent bad guys writing logic to detect which wallets are provided by my services. That's why they don't all have a fixed balance.
> Seems like you could achieve the same result if you just let your customers buy their own coins and provide an address for you to watch?
Yes - there are other services that do that for free already. This is more of an all-in-one setup for those who want to set-and-forget.
I think your colleague cloned the repo, and he had wallet stealing malware in his PC, which probably automatically stole it within milliseconds of the clone happening.
I thought that at this point it’s common sense that any secret pushed to a public GitHub repo should be considered compromised, regardless of how quick you roll it back. There are many people writing automated tools doing their best to catch slip-ups like this before everyone else. Dark Forest and all that. And as someone else said, why use a wallet holding mainnet private funds as a dev wallet? Separate your keys.
And these scripts can see my private GitHub repositories? If so, what's the difference between public and private repositories?
Is this a failure of GitHub's security?
I hope you're enjoying being your own bank and in full control of your resources. Maybe you need to ask your bank (yourself) about your security policies. /s (Information security is hard and you only have to make a mistake once.)
I thought that at this point it’s common sense that any secret pushed to a public GitHub repo should be considered compromised, regardless of how quick you roll it back. There are many people writing automated tools doing their best to catch slip-ups like this before everyone else. Dark Forest and all that. And as someone else said, why use a wallet holding mainnet private funds as a dev wallet? Separate your keys.
I think your colleague cloned the repo, and he had wallet stealing malware in his PC, which probably automatically stole it within milliseconds of the clone happening.