Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Admin Leaked AWS GovCloud Keys on GitHub

krebsonsecurity.com

Post reply on HN
Print view View original

51–60 of 205 posts

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#51

Post by yieldcrv »

epistasis wrote: post #48
yieldcrv wrote: post #25

Earlier quoted context omitted.

probably but a ton of services have popped up in the last 6 months specifically to help mitigate that localhost reading env from the cloud and other solutions to me it suggested that I’m already late on that idea, but I can understand how that puts me deeper in a bubble than others

I've been using SOPS, which dates back to 2015. It's well tested, robust, supports a ton of great backends. What other solutions have you seen? I'm actively looking around in the space!

dotenv launched as2 (agentic secret storage), for example

advertising it directly in the command line for people that were already using the package

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#52

Post by theozero »

nrub wrote: post #28
epistasis wrote: post #4

I think one thing that people are sleeping on is passing a ton of secrets to OpenAI and Anthropic or your OpenRouter by having a .env or secrets on disk in your repo, but not checked in Your LLM will happily read the entire file, ship it off to be training data for future versions of ChatGPT, and not raise any flags, because let's be fair it was on ok thing to check if all the env vars were set, or it you had set up…

I no longer keep my dotenv files in plaintext. I use `sops` to keep an encrypted env around and you can use tools like direnv to make them available to your shell while you're working. Obviously the LLM could print any of these secrets, but it's less likely. Additionally I find that at least claude seems to avoid reading the dotenv. And lastly, don't make any local secrets that important. Limited scope, dev accounts,…

You might like varlock - it helps keep secrets out of plaintext by using plugins to pull from various backends (aws ssm, gcp, vault, 1pass, etc). Also has built in local encryption with shared team vaults coming soon.

Additionally provides pre commit scanning, log redaction, and much more.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#54

Post by delfinom »

john_strinlai wrote: post #9

> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…

Dealing with IT departments run wild with cyber security monkeys that can only follow checklists with no independent thought.

The spreadsheet of passwords is a tad more common than it should be because the password managers don't meet whatever arbitrary checklist of invented cyber security requirements they blindly follow. But Excel does.

Lol

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#55

Post by theozero »

epistasis wrote: post #4

I think one thing that people are sleeping on is passing a ton of secrets to OpenAI and Anthropic or your OpenRouter by having a .env or secrets on disk in your repo, but not checked in Your LLM will happily read the entire file, ship it off to be training data for future versions of ChatGPT, and not raise any flags, because let's be fair it was on ok thing to check if all the env vars were set, or it you had set up…

Get everything out of plaintext!

Varlock is a great and flexible way to do this.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#56

Post by cozzyd »

epistasis wrote: post #41
cozzyd wrote: post #14

Earlier quoted context omitted.

it seems crazy to "trust" an LLM with any secrets. Anyone running one as their normal user account with access to all files is playing with fire...

I don't think anybody actively trusts a hosted LLM with secrets. The problem is that they don't realize they have granted trust to the LLM.

People happily run AI Desktop agents or whatever on their main user acounts commingled with ssh keys and who knows how many tokens.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#57

Post by sandeepkd »

binkHN wrote: post #50
john_strinlai wrote: post #17

Earlier quoted context omitted.

"crazy crazy" gets the same point across

Yeah, but the words gross negligence is legal for you're going to be sued for a whole lot of money.

While I agree that it should not have happened, at the same time its probably true that most people are never formally trained on security.

The real story here is a big gap in existing implementations where shared credentials are needed and used pretty much across all the systems but there are no good solutions for managing such use cases. People are naturally more sensitive about their personal secrets than something thats shared across the company/group

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#58

Post by doodlebugging »

debarshri wrote: post #5

They also uploaded sensitive docs in chatgpt [1] [1] https://www.politico.com/news/2026/01/27/cisa-madhu-gottumuk...

Reading that article makes it look like Trump/Noem filled positions with foreign moles. One day the American people will have an accounting.

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#59

Post by doctorpangloss »

epistasis wrote: post #4

I think one thing that people are sleeping on is passing a ton of secrets to OpenAI and Anthropic or your OpenRouter by having a .env or secrets on disk in your repo, but not checked in Your LLM will happily read the entire file, ship it off to be training data for future versions of ChatGPT, and not raise any flags, because let's be fair it was on ok thing to check if all the env vars were set, or it you had set up…

what exactly is the threat model?

user data is always paraphrased for training. what do you mean, not raise any flags?

look... Google is running your browser, Apple your messenger, Amazon your backend. They already have all these keys in the same way, are they misusing them? Why doens't it raise any flags then?

Re: CISA Admin Leaked AWS GovCloud Keys on GitHub

#60

Post by kittoes »

LelouBil wrote: post #10
ttul wrote: post #8

Yet another argument for the death of the API key. Replacements abound; let's get on with it.

Do you have any examples ? It's the first time I hear about replacing API keys

This can be done in Azure using Entra (OAuth). I don't have API keys, or passwords of any kind, anywhere in the stack.

Infrastructure - https://dev.azure.com/byteterrace/Koholint/_git/Azure.Resour...

Server - https://dev.azure.com/byteterrace/Koholint/_git/Web.Function...

Client - https://dev.azure.com/byteterrace/Koholint/_git/Web.Portal

Post reply on HN