Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Developer posts secret key on GitHub, loses $40K in 2 minutes

cointelegraph.com

Post reply on HN
Print view View original

41–50 of 93 posts

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#41

Post by diggan »

PinguTS wrote: post #37
diggan wrote: post #33

Earlier quoted context omitted.

> Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos? When you deal with high value amount of cryptocurrencies, you have a hardware wallet so things like these are not even possible in the first place, as the keys are safely stored in the hardware. Storing anything on disk (unencrypted at that) that corresponds to $40K is basically begging to be stolen fr…

Then you need to read through any file in any revision. Because if you have a newer commit with the secrets removed they are still in the history.

Or `rm -rf .git && git init && git commit -m "init"` and then read through. Common to scrap previous history when you go from private -> public repository anyways, a lot in order to scrub potential things like this to leak through.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#42

Post by tjoff »

Sayrus wrote: post #4

> When a community member inquired about how long it took for the funds to be drained, the Web3 founder responded that it took just two minutes for someone to withdraw the funds. The public events API is delayed by 5 minutes[1]. Unless someone was actively scraping his profile rather than doing large scans on GitHub, this is not possible. [1] https://docs.github.com/en/rest/activity/events?apiVersion=2...

Note he didn't commit his keys by mistake, but rather made a private repo public. Don't know if that makes a difference.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#43

Post by vouaobrasil »

The real tragedy here is not that he lost $40K, but that crypto is the controversy generator that is part of the bread and butter of mass media, which in turn is a large part of the reason why cryptocurrencies have value in the first place. The loss of $40K didn't just happen due to this developer's mistake, but also because he was able to store $40K in crypto in the first place, and that partially happened because of people like us, reading this news story.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#44

Post by Timpy »

Sayrus wrote: post #4

> When a community member inquired about how long it took for the funds to be drained, the Web3 founder responded that it took just two minutes for someone to withdraw the funds. The public events API is delayed by 5 minutes[1]. Unless someone was actively scraping his profile rather than doing large scans on GitHub, this is not possible. [1] https://docs.github.com/en/rest/activity/events?apiVersion=2...

I didn't read that to mean a literal two minutes. Based on his style of writing that was quoted in the article and the nature of his mistake I don't think he's reporting an in-depth postmortem on the situation, although I didn't bother going to twitter to take a closer look. He probably didn't even realize his mistake within two minutes.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#46

Post by immibis »

r2_pilot wrote: post #13
codetrotter wrote: post #6

Earlier quoted context omitted.

An EMP taking out the entire world power grid would be a complete disaster for everyone. Goldbugs and people with cash in their mattresses included.

I don't disagree with you that it would be a disaster, I'm just saying that fundamentally crypto is not a store of value. But don't listen to me, I only deliberately burned my early Bitcoin after evaluating it on its merits, weeks after it came out. Nothing, repeat nothing, has ever moved the needle on my opinion of crypto, although I will say that cryptobros will not stop at anything to try and convince people that…

Fundamentally, almost nothing is a store of money - not crypto, not fiat, not gold. Only a bunker full of canned food can actually store actual value. The rest is just an IOU from future people.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#47

Post by hahajk »

PinguTS wrote: post #37
diggan wrote: post #33

Earlier quoted context omitted.

> Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos? When you deal with high value amount of cryptocurrencies, you have a hardware wallet so things like these are not even possible in the first place, as the keys are safely stored in the hardware. Storing anything on disk (unencrypted at that) that corresponds to $40K is basically begging to be stolen fr…

Then you need to read through any file in any revision. Because if you have a newer commit with the secrets removed they are still in the history.

If I'm at all worried about having accidentally committed secrets in the past, I usually create a new repo for the public release with a fresh git init.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#48

Post by zeroxfe »

npsomaratna wrote: post #21

Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos? Edit: and what’s the best practice here? Is it using a key management system of some sort? (I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API)

Yes, standard is using a key management system (KMS), but there's a lot of nuance and complexity there. Depending on the threat model, you can use software systems, hardware systems, multiparty crypto systems, and you need to think through all kinds of failure modes very carefully (particularly around disaster recovery or insider attack scenarios.) A good place to start is cloud-based key management systems, because they take care of a lot of the complexity, but you still have to do it carefully (e.g., paper backups in a multiple safes, protecting the cloud resources correctly, 2FA on your account, etc.)

Protecting high-value cryptocurrencies is particularly hard, and as much as crypto people like to say "not your keys, not your coins", the reality is far more nuanced, and the average person is much better off using a well-known platform like Coinbase. Even hardware wallets are not as simple as people thing to use safely.

(If you're building cryptocurrency apps, never upload wallet private keys to cloud KMSs. Instead, generate wallet keys using the KMS itself, and use those wallets for small "in-transit" funds only. Think of them like bank branches, when you manually transfer small amounts of funds securely from a set of central wallets.)

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#49

Post by shakow »

r2_pilot wrote: post #5
chmod775 wrote: post #2

Some cryptocurrency isn't a safe store of value to begin with, so he was probably ready to lose that at any moment anyways. Worse way than most to lose it, but he doesn't sound too bummed out.

>Some cryptocurrency isn't a safe store of value to begin with... If I may, I would posit all crypto is not a safe store of value to begin with. An EMP taking out the entire world power grid would render crypto pretty useless almost immediately, while gold will just sit there. Even paper money is resistant to decentralized unwindings as they are physical and people are conditioned from birth to accept their value.

Most of the world money is purely numeric; only ~10% is printed in cash IIRC, so a worldwide EMP (outside of all its drastic consequences on the world) would wipe out much more value in fiat money than in cryptocurrency.

And most of the gold owned in the world is not in someone's basement, but as a line in a database; so you can wave goodbye to that as well.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#50

Post by ThrowawayTestr »

classified wrote: post #45

> a memecoin coded using the artificial intelligence chatbot has already found success within the crypto space. So you can still offer any random shitcoin and make money with it. Seriously, I've got the wrong job.

Lots of money to be made if you don't feel bad taking it from dumb people.
Post reply on HN