Why Deleting Sensitive Information from GitHub Doesn't Save You
jordan-wright.github.io
Why Deleting Sensitive Information from GitHub Doesn't Save You
1–10 of 91 posts
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#2It should be noted that GitHub's article on removing sensitive data is still applicable if you haven't pushed anything back to GitHub yet. Remember that a commit is just an entry into your repo, it doesn't synchronize with `origin/master` until you tell it to. So if the user has not pushed to GitHub yet, but has committed in their local Git repo, they should follow GitHub's guide and not worry about changing any keys.
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#3Millions of emails for developers and no one harvesting this info thought it wise to obfuscate it in some way?
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#4To be clear, the guide from GitHub that's linked at the top of this article clearly states that you should consider the sensitive data compromised. Cleaning it out of the repo is a good move, but it's a companion move to rotating out those creds or whatever for new ones.
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#5It should be noted that GitHub's article on removing sensitive data is still applicable if you haven't pushed anything back to GitHub yet. Remember that a commit is just an entry into your repo, it doesn't synchronize with `origin/master` until you tell it to. So if the user has not pushed to GitHub yet, but has committed in their local Git repo, they should follow GitHub's guide and not worry about changing any keys…
link pls?
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#6[deleted]
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#7It should be noted that GitHub's article on removing sensitive data is still applicable if you haven't pushed anything back to GitHub yet. Remember that a commit is just an entry into your repo, it doesn't synchronize with `origin/master` until you tell it to. So if the user has not pushed to GitHub yet, but has committed in their local Git repo, they should follow GitHub's guide and not worry about changing any keys…
link pls?
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#8It should be noted that GitHub's article on removing sensitive data is still applicable if you haven't pushed anything back to GitHub yet. Remember that a commit is just an entry into your repo, it doesn't synchronize with `origin/master` until you tell it to. So if the user has not pushed to GitHub yet, but has committed in their local Git repo, they should follow GitHub's guide and not worry about changing any keys…
While it's absolutely true that if the credentials haven't been pushed then you are not compromised, I would still encourage people to rotate their credentials regardless.
All it takes is a mistake when deleting the sensitive information, or having pushed without realizing it to be compromised. Even if you're absolutely positive there wasn't a breach, it can be a good excuse to drill for a _real_ breach later.
It never hurts to walk through the practice of what to do if credentials leak when there's no pressure.
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#9To be clear, the guide from GitHub that's linked at the top of this article clearly states that you should consider the sensitive data compromised. Cleaning it out of the repo is a good move, but it's a companion move to rotating out those creds or whatever for new ones.
That guide highlights this in its own box. In red.
Not sure how GitHub could make it more obvious.
Perhaps if they mentioned there are unscrupulous users out there who have a script that hammers GitHub's events API to search for exposed passwords/keys, then it would reduce the 'oops I only pushed it for a second' thinking that users likely go through.
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#10Millions of emails for developers and no one harvesting this info thought it wise to obfuscate it in some way?
Obfuscate the emails that are clearly visible on github.com? I think by this point it should be pretty clear that email addresses, like domain names, are not secret information. Obfuscating the data would have mangled useable information for a goal of blocking people who would have had no trouble gathering that information anyways.