Live data from Hacker News

Home Depot GitHub token exposed for a year, granted access to internal systems

techcrunch.com

41–50 of 169 posts

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#41
post #34

I’m surprised that GitHub, OpenAI etc. doesn’t have automation to scan the usual surfaces for hashes of their access tokens. It seems like a cheap and simple thing to offer your customers a little extra safety. Anybody interested in starting a platform agnostic service to do this?

Where was this token found, in an open source repo? There are numerous ways to scan commits, for free even in open source repos: https://docs.github.com/en/code-security/secret-scanning/int...

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#42
post #34

I’m surprised that GitHub, OpenAI etc. doesn’t have automation to scan the usual surfaces for hashes of their access tokens. It seems like a cheap and simple thing to offer your customers a little extra safety. Anybody interested in starting a platform agnostic service to do this?

They at least scan GitHub for all kind of exposed tokens in public repositories, and even have partnerships with the companies where you can connect with those tokens (SaaS, PaaS...) to verify they're valid and even revoke them automatically if necessary.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#43

Earlier quoted context omitted.

I feel like the home depot website is fine. It's a lot better than most other shops, I've had a good experience finding the aisle and location of items, and it's generally accurate with the amount in stock at each location. If you didn't enable precise location or have bad cell signal then that is hardly the fault of the website.

its generally in HD stores you never have cell signal or wifi

This is definitely true and makes the experience shittier than it otherwise would be, but even with a great signal/connection it frequently loads so slowly that I've long run out of patience.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#44

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

I've never had an employee know what a tool is, much less where to find it. All they're doing is doing this process on a slower, ruggedized phone.

I literally watched someone Google "masonry bit" right in front of me.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#46
post #34

I’m surprised that GitHub, OpenAI etc. doesn’t have automation to scan the usual surfaces for hashes of their access tokens. It seems like a cheap and simple thing to offer your customers a little extra safety. Anybody interested in starting a platform agnostic service to do this?

GitHub already has a program to scan for keys, since publishing Discord tokens by mistake used to get the token immediately revoked and a DM from the system account saying why

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#47

Earlier quoted context omitted.

They probably don't have any repeaters. All those metal shelves are going to interfere with the signal. I have the same experience.

Their in-store WiFi is a repeater more or less. It's one of those bullshit forced auto-join networks that you can't opt out of (at least on iOS). Because that's not a massive vector for phishing or anything.

Yes, although I've had terrible experience with their wifi. I'm sure it depends on the store, but coverage is usually terrible and highly spotty, so if you're walking around or standing in the wrong area, it stops working.

At one point I also had to disable wireguard because I think it was triggering some sort of anti-abuse thing they had. It wasn't even using an exit node, just bridging me to my home network so I could access self-hosted services. I get the desire for anti-abuse, but that felt pretty draconian and I don't expect the average person to consider they might have to disable a VPN to get it to work, especially nowadays when many average people do have VPNs running.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#48

Earlier quoted context omitted.

If you’ve ever tried to find an employee in one of their stores, this won’t be very surprising.

Purely anecdotal, but I found Lowe's generally had much better customer service. But maybe it's just where I live

That was true for a long time, but before that, Home Depot's customer service was terrific too. I think that's a cost that gets cut by a focus on shareholder value. Local hardware stores are still going to be better, with the caveat it may take a decade before they smile when you walk in.

Re: Home Depot GitHub token exposed for a year, granted access to internal systems

#49

Given the absolute state of their website on mobile it's hardly surprising. It's faster to find an employee and ask them where an item is at instead of waiting for the search to finish, see that it the "current store" now points to a random location somewhere in a different state, pick the correct store and re-do the search

If you go to the home depot page for torque wrenches and click the filter for drive size, you get this list: 1/2 in 1/4 in 1 in 3/8 in 3/4 in Specialty Here is the same list in decimal to make the insanity plainly obvious: 0.5 0.25 1 0.375 0.75 What sadistic lunatic made that sort order?! It's not based on size and it's not alphabetic.

Now look up impact wrenches.

  1/2 in
  1 in
  1/4 in
  3/8 in
  3/4 in
  7/16 in
Post reply on HN