Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 39 Algolia admin keys exposed across open source documentation sites

benzimmermann.dev

Post reply on HN
Print view View original

51–60 of 62 posts

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#51

Post by Dazzler5648 »

Thanks for this. I was maybe using one of these keys until this morning. When I logged in at dashboard.algolia.com and went to Settings -> API Keys, I found that none of the keys (Search, Analytics, Usage, Monitoring) matched the key I was using on a frontend. I made a decent attempt looking for that old key anywhere in their admin panels and could not find it. poof!

So perhaps at some point, they were only giving admin keys (because I don't remember there being a choice; and I would think given the choice I'd make the right one) and when called out (or sometime prior) realized the problem and made a new Settings -> API Keys page. Currently on the page the first one listed is the Search Key, with the subtext "This is the public API key which can be safely used in your frontend code. This key is usable for search queries and it's also able to list the indices you've got access to."

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#56

Post by mmooss »

pwdisswordfishy wrote: post #49
gregoriol wrote: post #37

Earlier quoted context omitted.

Why contact Algolia when it is the users' responsibility to handle their keys? Contact all the users.

The comment you're responding to is output of an LLM.

Note all the very similar grey comments at the bottom of the page.

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#58

Post by tcbrah »

pwdisswordfishy wrote: post #49
gregoriol wrote: post #37

Earlier quoted context omitted.

Why contact Algolia when it is the users' responsibility to handle their keys? Contact all the users.

The comment you're responding to is output of an LLM.

ill take that as a compliment, my writing finally passed the turing test

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#59

Post by nightpool »

TurdF3rguson wrote: post #25
richbell wrote: post #18

Earlier quoted context omitted.

If you find an exposed token in the wild, for a service supported by GitHub Secret Scanning, uploading it to a Gist will either immediately revoke it or notify the owner.

Ok I see, so any public gist with an algolia key in it will get invalidated? And it would have to follow some pattern like ALGOLIA_KEY=xxx ?

it works for any gist, public or private. it doesn't need to follow a certain format. it's just based on how the secret itself is formatted—it works for secrets that have a predictable pattern, like the AWSK prefix for Amazon keys.

if algolia keys have this predictable pattern, then they can enroll in secret scanning. If they don't then they probably can't

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#60

Post by pwdisswordfishy »

wat10000 wrote: post #50
pwdisswordfishy wrote: post #48

Earlier quoted context omitted.

No it's not.

Yes it is. Reminding somebody of this feature is useful to somebody, even if it's not completely relevant to the topic being discussed. Calling out a supposed tautology is the opposite of useful: it helps nobody and just clutters things up.

> Reminding somebody of this feature is useful to somebody, even if it's not completely relevant to the topic being discussed.

Yeah, it's especially useful in that case. Useful to attackers, because someone "helpfully" showed up with "reminder" that reads like a suggestion to post these specific secrets (or any other Algolia secrets that other HNers might have come across) in the open out of some misguided belief that doing so will invalidate them.

This has to be one of the dumbest, most reckless threads to have been posted (and so vociferously defended) on HN.

Post reply on HN