[dead]
I found 10k GitHub repositories distributing Trojan malware
161–170 of 268 posts
Re: I found 10k GitHub repositories distributing Trojan malware
#162Earlier quoted context omitted.
>Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. That seems somewhat unrealistic? There are many passwords you need to use as part of dev work.
One could perhaps put those in a different vault. Sounds like a pain to me. But nothing compared to an email and/or banking compromise.
It becomes tricky when all your passwords are randomly generated, 24 characters long, full of symbols, special characters, casing variations, etc. All of mine are an absolute nightmare to type manually.
I suppose that becomes a pretty strong argument for passphrases + MFA, because passphrases are much easier to type in manually. But the problem there is lots of services still have stupid/arbitrary maximum password length restrictions that make it difficult or impossible to use a sufficiently complex passphrase.
It’s very frustrating.
Re: I found 10k GitHub repositories distributing Trojan malware
#163Any open source tool to scan a github repo before download/install it locally? I'm thinking of semgrep or socket.dev but I wonder if there's a better option
Virus total should be scanning GIthub at the least, because it is a job MS Defender can't appear to itself.
Re: I found 10k GitHub repositories distributing Trojan malware
#164> Why do they delete a commit and push a new one every few hours? May be to make it appear on the top of the "Last Updated" repositories in case someone searches for the repo or a keyword. So instead of the author's actual repo, the users endup cloning the trojan infected one.
Bingo!
They're also gaming the heuristic that if an OSS repo hasn't had any pushes in ~6mos many users consider it defunct.
Re: I found 10k GitHub repositories distributing Trojan malware
#165Earlier quoted context omitted.
Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.
> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…
> Important TOTPs can go to Yubikeys.
Once you have a Yubikey (preferably two, so you have a backup if you damage/lose one) - you may as well make _that_ your primary MFA method, and only use TOTP for services you can't enrol your Yubikeys on.
Re: I found 10k GitHub repositories distributing Trojan malware
#166Earlier quoted context omitted.
One could perhaps put those in a different vault. Sounds like a pain to me. But nothing compared to an email and/or banking compromise.
It becomes tricky when all your passwords are randomly generated, 24 characters long, full of symbols, special characters, casing variations, etc. All of mine are an absolute nightmare to type manually. I suppose that becomes a pretty strong argument for passphrases + MFA, because passphrases are much easier to type in manually. But the problem there is lots of services still have stupid/arbitrary maximum password le…
You can generate "pronounceable" passwords in some tools.
1PW just generated this for me: mimp-rort-jan-mon-kain-sqin
Not as much entropy as 24 random letters/digit/punctuations/capitalisation. But (for me at least) much easier to read end type in situations where copy/paste isn't available (like from my phone to my dev docker containers)
Re: I found 10k GitHub repositories distributing Trojan malware
#167Earlier quoted context omitted.
> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…
That’s a good point. Maybe a good compromise is to use 1pw for most TOTP but keep your gmail / iCloud and a few others in an iPhone only app? Gmail is what scares me the most. It’s basically keys to the kingdom.
> Gmail
We might all do well to remind F&F to print out account recovery codes, and then put some thought into where they'll be safe.
Re: I found 10k GitHub repositories distributing Trojan malware
#168Same thing happened to one of my repos in Feb. I wrote up the details with screenshots. https://reducibl.com/writing/someone-used-my-repo-to-distrib...
Did Github ever do anything?
Re: I found 10k GitHub repositories distributing Trojan malware
#169Earlier quoted context omitted.
This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match
I use keepass (FOSS under GPL, fully offline). It does not detect domains.
Maybe use a better one or the browser extension like other commenters are saying?
Re: I found 10k GitHub repositories distributing Trojan malware
#170> I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results Side story, this kind of thing is what made me stop using Bing. I had been using it as the default for searches (it sucks, but it's at least not Google), until I landed on a phishing page for my bank (I haven't committed it to memory yet). The pag…
This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match
Unfortunately it's not uncommon to find legitimate websites that break autofill in some ways. And the more such websites a user encounters, the more likely he will just mindlessly paste his password into a phishing site as he has learned to do for real ones.
Passkeys solve this problem but has its own usability issues.