How to mitigate risk from secrets leaks • Hacker News Board

Re: How to mitigate risk from secrets leaks

#11

Post by taeric » Sat, May 27, 2023, 10:32 PM UTC

lioeters wrote: post #3

revskill wrote: post #2

100% developers leaked JWT token .

Aren't JWT tokens supposed to be public?

No? They are literally your authentication. They are time limited, but still pretty private.

Done well, they have an audience set for what they authenticate. Which can limit the exposure back to the issuer. But you are supposed to trust that holding the token means you know who the user is.

Right?

Re: How to mitigate risk from secrets leaks

#12

Post by treve » Sat, May 27, 2023, 10:33 PM UTC

lioeters wrote: post #3

revskill wrote: post #2

100% developers leaked JWT token .

Aren't JWT tokens supposed to be public?

Depends on the context. JWTs are very often used as a type of session token. So if your token is public, it might allow someone to act on your behalf for whatever service you're using.

So while users are allowed to read the token and its contents, you don't want user-identifying tokens to fall in the hands of someone else.

You might be thinking of a public key.

Re: How to mitigate risk from secrets leaks

#13

Post by bigmattystyles » Sat, May 27, 2023, 10:34 PM UTC

It’s way higher than that if you mean just leaving it in an MR or even checking it in. Or even a relatively open internal file system. It’s not if, it’s about the plan when you do.

Re: How to mitigate risk from secrets leaks

#14

Post by cowsup » Sat, May 27, 2023, 10:36 PM UTC

londons_explore wrote: post #6

Does this include deliberately sharing an API key, but in a 'not best practices' way? ie. "Here, just run document.cookie='SID=EB73542386AF235' " Then you'll be logged in as an account that can do what you're trying to do.

No. This checks public GitHub commits that contain secret credentials; in 2022, over 33% were specific to known APIs, such as AWS access keys or MongoDB credentials, while the remaining 67% were deemed "generic." According to the report, generic ones include secrets such as "a company email and a password that would end up hard-coded in a file."

It's not scanning developer support tickets to see when devs hand over credentials to specific individuals.

Re: How to mitigate risk from secrets leaks

#15

Post by alexk » Sat, May 27, 2023, 10:39 PM UTC

You can't leak API keys if there are no API keys to leak! The article recommends OIDC for apps, which is a step up, especially if you rotate the bearer token, however there is another option - use short-lived certs.

Our project Machine ID is replacing API keys with short-lived certificates:

https://goteleport.com/docs/machine-id/introduction/

Another great option is SPIFFEE https://spiffe.io/

The adoption is slower than we wanted, because it's not trivial to replace API keys, but we see more and more companies using mTLS + short lived certs as alternative to shared secrets.

Re: How to mitigate risk from secrets leaks

#16

Post by yarg » Sat, May 27, 2023, 10:42 PM UTC

adhesive_wombat wrote: post #10

djbusby wrote: post #7

Earlier quoted context omitted.

I try hard to just say "the JWT". But I also try to only say "ATM"

Bonus points if you pronounce it like a Greek "ω" (joat) or a Welsh "w" (joot)!

That's omega?

Re: How to mitigate risk from secrets leaks

#17

Post by Macha » Sat, May 27, 2023, 10:48 PM UTC

This seems implausibly high. Is it including stuff like putting password=replaceme in an example config file?

Re: How to mitigate risk from secrets leaks

#18

Post by replygirl » Sat, May 27, 2023, 10:51 PM UTC

yarg wrote: post #16

adhesive_wombat wrote: post #10

Earlier quoted context omitted.

Bonus points if you pronounce it like a Greek "ω" (joat) or a Welsh "w" (joot)!

That's omega?

you're telling me the w doesn't stand for rapture?

Re: How to mitigate risk from secrets leaks

#19

Post by danappelxx » Sat, May 27, 2023, 10:52 PM UTC

alexk wrote: post #15

You can't leak API keys if there are no API keys to leak! The article recommends OIDC for apps, which is a step up, especially if you rotate the bearer token, however there is another option - use short-lived certs. Our project Machine ID is replacing API keys with short-lived certificates: https://goteleport.com/docs/machine-id/introduction/ Another great option is SPIFFEE https://spiffe.io/ The adoption is slower t…

How does this approach practically differ from using short-lived JWTs+TLS?

Re: How to mitigate risk from secrets leaks

#20

Post by [deleted] » Sat, May 27, 2023, 10:54 PM UTC

hanyiwang wrote: post #9

and that's why you use secret managers like infisical

[deleted]