Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Admin Leaked AWS GovCloud Keys on GitHub

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 205 posts

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#11

Post by giancarlostoro »

epistasis wrote: post #4

I think one thing that people are sleeping on is passing a ton of secrets to OpenAI and Anthropic or your OpenRouter by having a .env or secrets on disk in your repo, but not checked in Your LLM will happily read the entire file, ship it off to be training data for future versions of ChatGPT, and not raise any flags, because let's be fair it was on ok thing to check if all the env vars were set, or it you had set up…

Claude told me to revoke an API key I accidentally pasted (was for a side project and I was getting it on its legs) just flat out did not want it. I have a feeling that if it needs something out of an env file it will grep for the specific line.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#12

Post by doctoboggan »

epistasis wrote: post #4

I think one thing that people are sleeping on is passing a ton of secrets to OpenAI and Anthropic or your OpenRouter by having a .env or secrets on disk in your repo, but not checked in Your LLM will happily read the entire file, ship it off to be training data for future versions of ChatGPT, and not raise any flags, because let's be fair it was on ok thing to check if all the env vars were set, or it you had set up…

I've noticed recently that at least Claude will try its best not to read your env files. You really need to push it in the prompt if you want it to read and access your DB for example.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#14

Post by cozzyd »

epistasis wrote: post #4

I think one thing that people are sleeping on is passing a ton of secrets to OpenAI and Anthropic or your OpenRouter by having a .env or secrets on disk in your repo, but not checked in Your LLM will happily read the entire file, ship it off to be training data for future versions of ChatGPT, and not raise any flags, because let's be fair it was on ok thing to check if all the env vars were set, or it you had set up…

it seems crazy to "trust" an LLM with any secrets. Anyone running one as their normal user account with access to all files is playing with fire...

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#15

Post by tantalor »

john_strinlai wrote: post #9

> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…

The word you're looking for is "gross negligence"

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#16

Post by leoooodias »

LelouBil wrote: post #10
ttul wrote: post #8

Yet another argument for the death of the API key. Replacements abound; let's get on with it.

Do you have any examples ? It's the first time I hear about replacing API keys

Workload identity. Whatever is using an API key could instead be given an identity, and narrow privileges assigned to that identity. API keys tend to be overscoped/overprivileged.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#17

Post by john_strinlai »

tantalor wrote: post #15
john_strinlai wrote: post #9

> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…

The word you're looking for is "gross negligence"

"crazy crazy" gets the same point across

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#18

Post by jpalawaga »

LelouBil wrote: post #10
ttul wrote: post #8

Yet another argument for the death of the API key. Replacements abound; let's get on with it.

Do you have any examples ? It's the first time I hear about replacing API keys

OAuth with refresh tokens.

IAM roles/workload identity.

Even time-limited or signed JWT, though has a separate issues.

Maybe you'll say 'those are both just text values passed like an apikey' though api keys don't frequently rotate/time limited, which is an important security feature.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#19

Post by [deleted] »

john_strinlai wrote: post #9

> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…

[deleted]
Post reply on HN