SSH Keys on GitHub • Hacker News Board

Re: SSH Keys on GitHub

#21

Post by mod » Tue, Aug 18, 2015, 5:10 PM UTC

[deleted] wrote: post #11

[deleted] wrote: post #10

[deleted]

[deleted]

You're wrong on both counts.

I'm not even sure what you're talking about, really.

Re: SSH Keys on GitHub

#22

Post by Kenji » Tue, Aug 18, 2015, 5:15 PM UTC

jnevill wrote: post #19

You can search out private GPG keys as well, which is crazy-bananas. https://github.com/search?utf8=%E2%9C%93&q=filename%3Aasc+BE...

So much for no forward secrecy :D

Re: SSH Keys on GitHub

#23

Post by ams6110 » Tue, Aug 18, 2015, 5:16 PM UTC

bagels wrote: post #2

Does Github have a responsibility to help people out with this kind of thing? What do you all think?

No, once they start screening content they take on liability. I'm surprised they've done as much as they have e.g. with the "retarded" controversy.

Re: SSH Keys on GitHub

#24

Post by allworknoplay » Tue, Aug 18, 2015, 5:20 PM UTC

This is matching both "id" and "rsa" individually as well, so not all results are actually files with id_rsa in the name.

Example: https://github.com/search?utf8=%E2%9C%93&q=filename%3Aid_rsa...

Re: SSH Keys on GitHub

#25

Post by avinassh » Tue, Aug 18, 2015, 5:22 PM UTC

And if you want to get the public key also:

.keys" rel="nofollow">https://github.com/.keys

ex.: https://github.com/avinassh.keys

Re: SSH Keys on GitHub

#26

Post by H2CO3 » Tue, Aug 18, 2015, 5:37 PM UTC

Update: This is no longer working: https://imgur.com/uT1fCRT

Re: SSH Keys on GitHub

#27

Post by orbjuice » Tue, Aug 18, 2015, 5:39 PM UTC

They have blocked the search for private keys (id_rsa) but they still need to block the search for public keys (id_rsa.pub); they're usually stored together anyway. I just did this search.

Re: SSH Keys on GitHub

#28

Post by geographomics » Tue, Aug 18, 2015, 5:39 PM UTC

Looks like they've blocked it now. Searching via Google still works though: https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid...

Re: SSH Keys on GitHub

#29

Post by mosburger » Tue, Aug 18, 2015, 5:40 PM UTC

Hmmph. I just found a bunch of free AWS keys by searching for amazon.yml, too.

What is the best way to share things like API keys among a team of developers, anyway? I'm surprised this hasn't been solved already (perhaps it has and I just don't know about it). I know you can share passwords with tools like LastPass and 1Password, and I suppose you could use those for API keys as well?

It'd be nice if you could, e.g., include a gem in a Rails project, get a single key/password/token from one of the team members on that project, and use that w/ a third party API to set all the requisite API keys for all the third party services used on a project. You could also rotate the master password when team members leave the group.

Re: SSH Keys on GitHub

#30

Post by herge » Tue, Aug 18, 2015, 5:47 PM UTC

akerl_ wrote: post #18

I feel like this gets posted every other month or so. I appreciate the awareness, but it doesn't seem like there's much new discussion or debate to have on the matter: folks continue to be a bit more careless with credentials than they ought to be / don't think about what pushing something to a public site means / etc, it would rock if GitHub was more proactive about messaging affected users, it sucks that it's hard…

Wasn't that the point of lulzsec?