Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota suffered a data breach by accidentally exposing a secret key on GitHub

blog.gitguardian.com

Post reply on HN
Print view View original

221–230 of 272 posts

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#221

Post by bisby »

leesalminen wrote: post #138
bisby wrote: post #99

Earlier quoted context omitted.

It's tough. I'm our public security reporting email list. We get a lot of things that boil down to "When I go to your website, I am able to see the content of your html files!" ... yes, reporter. That is what a web server does. It gives you HTML files. Congrats that you have figure out the dev console on your browser, but you're not a hacker. I'm trying to go with Hanlon's razor here and assume this is inexperienced…

> Sometimes having a place for responsible disclosure just opens yourself up to doing more paperwork 100% this. And it bites harder when you’re a scrappy time constrained startup, or just offering a public service. I maintain a public API that returns public information- observable facts about the world. As such, the API doesn’t have any authn/z. Anyone can use it as little or as much as they want, free of charge. Of…

Or this! It's not just paperwork, but also mental capacity. Having a place for responsible disclosure yields enough "fake" disclosures that you become desensitized to it. Boy who cried wolf style.

It's possible "security isn't a concern" because they are dismissing the report, not the security.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#222

Post by baxtr »

gw99 wrote: post #213
baxtr wrote: post #201

Earlier quoted context omitted.

Is there a corresponding ISO control for this?

There probably is but ISO certs are just paperwork filed. Reality is different.

Sure. But then again you need a framework to approximate reality. ISO isn’t perfect by any means. But it’s a start.

What do you use?

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#223

Post by ChrisMarshallNY »

scarface74 wrote: post #218
ChrisMarshallNY wrote: post #207

Earlier quoted context omitted.

I deal with this by having a directory in my development tree, named ”doNotCheckThisIntoSourceControl” , and I add a wildcard of it to my global .gitignore. I’ll put things like server secrets and whatnot, there. Of course, I need to make sure the local directory is backed up, on this end, since it is not stored in git. Works a treat.

That’s really not a great idea…

...and why?

I am serious. If there is a better way, I'd use it.

Remember that I don't do online/server-based stuff. Most of my projects are for full compilation/linking, and rendering into host-executable, binary apps. There's a bunch of stuff in my development process that never needs to see a server.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#224

Post by lordgrenville »

bsimpson wrote: post #35

The social media manager at GitGuardian is winning. They just got us each to read a 1000 word ad for GitGuardian.

By writing an well-constructed and discussion-provoking article? "Mission fucking accomplished" https://xkcd.com/810/

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#225

Post by TheRealDunkirk »

bsimpson wrote: post #35

The social media manager at GitGuardian is winning. They just got us each to read a 1000 word ad for GitGuardian.

This. I used to use them, because I, too, have been burned by my own mistakes before. However, I had to stop using them as a plugin for GitHub because (at least when I was looking) there doesn't seem to be a way to exclude private repos from the reporting, and there were some false positives in private repos I don't want flagged. But I think the service is a good idea in general.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#226

Post by scarface74 »

ChrisMarshallNY wrote: post #223
scarface74 wrote: post #218

Earlier quoted context omitted.

That’s really not a great idea…

...and why? I am serious. If there is a better way, I'd use it. Remember that I don't do online/server-based stuff. Most of my projects are for full compilation/linking, and rendering into host-executable, binary apps. There's a bunch of stuff in my development process that never needs to see a server.

A super simple way is to have a script in your home directory - far away from your repos - that set environment variables that you read in your configuration.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#227

Post by ChrisMarshallNY »

scarface74 wrote: post #226
ChrisMarshallNY wrote: post #223

Earlier quoted context omitted.

...and why? I am serious. If there is a better way, I'd use it. Remember that I don't do online/server-based stuff. Most of my projects are for full compilation/linking, and rendering into host-executable, binary apps. There's a bunch of stuff in my development process that never needs to see a server.

A super simple way is to have a script in your home directory - far away from your repos - that set environment variables that you read in your configuration.

That makes sense. I could do something like that.

[UPDATE] I ended up doing something even simpler. I have issues with running scripts during the build process, unless really necessary (I have done it, and will, again).

Since this is Xcode, I simply needed to store the file in a directory (still with the global ignored name) far out of my dev tree, and dragged the file into the IDE.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#228

Post by throwaway290 »

miohtama wrote: post #219
gl-prod wrote: post #170

Earlier quoted context omitted.

Yeah, prefixing your keys with your service name like SRVCE_{KEY} is the way to go. Bonus: adding SRVCE_PRVT_{KEY} and SRVCE_PUB_{KEY}.

There is already RTC 8958 Secret token scheme for this, so you do not need to invent your own prefix https://datatracker.ietf.org/doc/html/rfc8959

I see this standard linked here a lot. Did anyone read it though? It only helps with identifying whether a string is a secret, not at all the service or environment where the secret applies.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#229

Post by semiquaver »

GoblinSlayer wrote: post #208
comboy wrote: post #143

Earlier quoted context omitted.

TIL: make private key for your service easy to match with regexps

I don't think it's a regex pattern, most keys are random strings.

That’s the idea. Add a deterministic prefix to make it identifiable as associated with a specific service.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

#230

Post by throwaway290 »

baxtr wrote: post #201
gw99 wrote: post #101

Earlier quoted context omitted.

Just stick an Amazon t shirt on, a reflective yellow waistcoat and a box and you can walk into most SMEs without anyone blinking an eye. I've seen it done hundreds of times...

Is there a corresponding ISO control for this?

At least falls under 31000's framework for identifying and dealing with risk
Post reply on HN