61–70 of 205 posts
Earlier quoted context omitted.
Do you have any examples ? It's the first time I hear about replacing API keys
OAuth with refresh tokens. IAM roles/workload identity. Even time-limited or signed JWT, though has a separate issues. Maybe you'll say 'those are both just text values passed like an apikey' though api keys don't frequently rotate/time limited, which is an important security feature.
Then the LLM slurps up your refresh token. What's next?
Earlier quoted context omitted.
Sure, it could be incompetence. It could also be an intentional strategy to tie up CISA/DHS resources, poison or obstruct CISA/DHS investigations/operations, open up systems to sunlight and journalism, or cause general chaos. The not-responding-when-notified part makes me think it's not just incompetence.
>The not-responding-when-notified part makes me think it's not just incompetence. Strong disagree. The person in question probably thought it was a private repo on Github and had a massive deer in headlights reaction when they got contacted. Whoever this is, lost their job, possibly security clearance and more. This was 100% life altering "mistake"/gross incompetence decision they made.
That doesn't support the theory that it was a mistake. That was intentional action. Maybe he was being blackmailed, and was coerced to do it. Or maybe he was a foreign agent or sympathizer who had infiltrated the organization.
> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…
DOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them. It is a bad plan that has and will continue to harm people, but it is intentional.
Earlier quoted context omitted.
OAuth with refresh tokens. IAM roles/workload identity. Even time-limited or signed JWT, though has a separate issues. Maybe you'll say 'those are both just text values passed like an apikey' though api keys don't frequently rotate/time limited, which is an important security feature.
> OAuth with refresh tokens. Then the LLM slurps up your refresh token. What's next?
Sure, a leak would be bad but I'd argue that it's orders of magnitude less likely compared to the accepted norm.
Earlier quoted context omitted.
OAuth with refresh tokens. IAM roles/workload identity. Even time-limited or signed JWT, though has a separate issues. Maybe you'll say 'those are both just text values passed like an apikey' though api keys don't frequently rotate/time limited, which is an important security feature.
> OAuth with refresh tokens. Then the LLM slurps up your refresh token. What's next?
> Valadon said he reached out because the owner in this case wasn’t responding and the information exposed was highly sensitive. obviously leaking the credentials itself is crazy, given that its (a contractor to) CISA, but to not respond when notified? crazy crazy. but wait! it gets worse somehow " “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems " w…
The word you're looking for is "gross negligence"
Earlier quoted context omitted.
OAuth with refresh tokens. IAM roles/workload identity. Even time-limited or signed JWT, though has a separate issues. Maybe you'll say 'those are both just text values passed like an apikey' though api keys don't frequently rotate/time limited, which is an important security feature.
So how would this help in this case? The oauth info would’ve just been in the csv or in someone’s env file.
The server still does authorisation on top. And unless you control the private keys, you cannot mint JWTs that are accepted as legitimate.
So the "info" leaking is really not a problem.
Earlier quoted context omitted.
DOGE. It's DOGE. This is just things going according to plan for people that think the US government is too powerful or that there is a fortune to be made in stealing public sector resources and privatizing them. It is a bad plan that has and will continue to harm people, but it is intentional.
Which DOGE employee put this file on GitHub?
https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...
> Elon Musk’s Department of Government Efficiency (DOGE) has fired more than a hundred employees working for the U.S. government’s cybersecurity agency CISA, including “red team” staffers, two people affected by the layoffs told TechCrunch.
Earlier quoted context omitted.
>The not-responding-when-notified part makes me think it's not just incompetence. Strong disagree. The person in question probably thought it was a private repo on Github and had a massive deer in headlights reaction when they got contacted. Whoever this is, lost their job, possibly security clearance and more. This was 100% life altering "mistake"/gross incompetence decision they made.
the CISA administrator disabled the default setting in GitHub that blocks users from publishing SSH keys or other secrets in public code repositories. That doesn't support the theory that it was a mistake. That was intentional action. Maybe he was being blackmailed, and was coerced to do it. Or maybe he was a foreign agent or sympathizer who had infiltrated the organization.
I've been a government contractor before, it does not employ best and brightest, it employs the average and below generally.