Toyota suffered a data breach by accidentally exposing a secret key on GitHub

Post by Breza » Tue, Oct 25, 2022, 1:38 PM UTC

hunter2_ wrote: post #166

comboy wrote: post #143

Earlier quoted context omitted.

TIL: make private key for your service easy to match with regexps

Reminds me of how Airbnb redacts Hawaiian street addresses because they look too much like phone numbers, literally replacing them with a "phone number hidden" string in the host|guest chat. Moral of the story: make your keys regexable without likelihood of false positives!

I spend a lot of time working with physician data. In the USA, physicians have a registration system called NPI. Apparently, NPI numbers are in the same format as some passport numbers. I know this because I started getting angry warnings about PII sharing until I got our tech team to turn them off.

Post by Mutjake » Wed, Oct 26, 2022, 4:03 PM UTC

scarface74 wrote: post #165

Mutjake wrote: post #163

Earlier quoted context omitted.

Hindsight is 20/20, but definitely one of those places where flat out giving the credentials should not even be an option (or it should be made artificially tedious and/or explicitly clear that it’s a bad idea by e.g. naming the param _this_is_a_bad_idea_use_credentials_file_instead_secret_key or so). Of course there are always edge cases in the vein of running notebooks in containers (probably not an optimal example…

> at least cli v2 makes bootstrapping the credentials to a workstation a tad easier! I know I should know this seeing that I work in ProServe at AWS, but what do you mean? I’m going to say there is never a use case for embedding credentials just so I can invoke Cunningham’s Law on purpose. But when I need to test something in Docker locally I do docker run -e AWS_ACCESS_KEY_ID= -e AWS_SECRET_ACCESS_KEY= -e AWS_DEFAUL…

I meant the aws configure import which they added — point it to the credentials csv and the cli handles adding the entry to the credentials file.

Sometimes you might need to use stuff that for some reason fails to use the envars, I think I’ve bumped into some stuff which reads s3 via self-rolled http calls. Dunno if it was to save from having boto as a dependency, but those things are usually straightforwardly engineered so no logic in figuring out the other, more smart ways to handle the keys. Here are the parameter slots, enter keys to continue.

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub

Re: Toyota suffered a data breach by accidentally exposing a secret key on GitHub