Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
1–10 of 60 posts
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#2Hmmm my idea would be
"Hello from github,
We detected that you uploaded credentials to NAME_OF_REPO. We strongly advise against this as it allows attackers to easily gain unauthorized access to your software and infrastructure.
Have a look at this blog where we discuss alternatives"
EDIT: Just to be clear, I'm not suggesting a ban at all, just a friendly email in response to commits that introduce credentials to public repos
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#3Hmmm my idea would be "Hello from github, We detected that you uploaded credentials to NAME_OF_REPO. We strongly advise against this as it allows attackers to easily gain unauthorized access to your software and infrastructure. Have a look at this blog where we discuss alternatives" EDIT: Just to be clear, I'm not suggesting a ban at all, just a friendly email in response to commits that introduce credentials to publ…
Is there a disadvantage to banning private keys in public repos?
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#4Hmmm my idea would be "Hello from github, We detected that you uploaded credentials to NAME_OF_REPO. We strongly advise against this as it allows attackers to easily gain unauthorized access to your software and infrastructure. Have a look at this blog where we discuss alternatives" EDIT: Just to be clear, I'm not suggesting a ban at all, just a friendly email in response to commits that introduce credentials to publ…
Is there a disadvantage to banning private keys in public repos?
Well, misdetection and examples for one.
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#5Hmmm my idea would be "Hello from github, We detected that you uploaded credentials to NAME_OF_REPO. We strongly advise against this as it allows attackers to easily gain unauthorized access to your software and infrastructure. Have a look at this blog where we discuss alternatives" EDIT: Just to be clear, I'm not suggesting a ban at all, just a friendly email in response to commits that introduce credentials to publ…
Is there a disadvantage to banning private keys in public repos?
I personally upload private keys in repos for some test scenarios and examples (dummy private keys of course). I often don’t want to write a test harness to generate the data for each run. Sue me!
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#6Dumb people :(
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#7Hmmm my idea would be "Hello from github, We detected that you uploaded credentials to NAME_OF_REPO. We strongly advise against this as it allows attackers to easily gain unauthorized access to your software and infrastructure. Have a look at this blog where we discuss alternatives" EDIT: Just to be clear, I'm not suggesting a ban at all, just a friendly email in response to commits that introduce credentials to publ…
Is there a disadvantage to banning private keys in public repos?
Yes, business wise github is a git hosting site. If they started implementing rules on how you structure your application customers would get frustrated and move away.
Just to be clear, I'm not suggesting a ban at all, just a friendly email in response to commits that introduce credentials to public repos
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#8Hmmm my idea would be "Hello from github, We detected that you uploaded credentials to NAME_OF_REPO. We strongly advise against this as it allows attackers to easily gain unauthorized access to your software and infrastructure. Have a look at this blog where we discuss alternatives" EDIT: Just to be clear, I'm not suggesting a ban at all, just a friendly email in response to commits that introduce credentials to publ…
Is there a disadvantage to banning private keys in public repos?
A fair amount of the google hits are for test certs that allow the test suite for the software to run.
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#9Slightly related question about API keys that rely on referer (say Google Vision) - what stops me using curl to spoof referer and rake in thousands in someone’s bill (15 cents per 1k recognitions)?
I assume there’s some IP based quota, but I haven’t seen a knob for that on GCP at least.
Re: Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KEY-----”
#10Hmmm my idea would be "Hello from github, We detected that you uploaded credentials to NAME_OF_REPO. We strongly advise against this as it allows attackers to easily gain unauthorized access to your software and infrastructure. Have a look at this blog where we discuss alternatives" EDIT: Just to be clear, I'm not suggesting a ban at all, just a friendly email in response to commits that introduce credentials to publ…
Now I think about it there are companies better placed to do this, code climate, codacy et al.