Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My MetaMask Private Keys Stolen from GitHub Private Repo in 1 Hour

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 47 posts

Re: My MetaMask Private Keys Stolen from GitHub Private Repo in 1 Hour

#31

Post by pjc50 »

anm89 wrote: post #28
pjc50 wrote: post #8

I hope you're enjoying being your own bank and in full control of your resources. Maybe you need to ask your bank (yourself) about your security policies. /s (Information security is hard and you only have to make a mistake once.)

What he is doing should have been secure. The question is valid. How were the keys exposed from a private repo?

"Secure" is kind of a relative term, it only exists with regard to a threat model and a likely spectrum of attacks. Simply having the key in plaintext on a developer PC connected to the regular internet is fairly low-security to start with; there are all sorts of opportunities for coincidental compromise that may have exposed it directly from his PC or his collaborator's PC.

Re: My MetaMask Private Keys Stolen from GitHub Private Repo in 1 Hour

#32

Post by pjc50 »

x86_64Ubuntu wrote: post #26
londons_explore wrote: post #9

I think your colleague cloned the repo, and he had wallet stealing malware in his PC, which probably automatically stole it within milliseconds of the clone happening.

This is a horrifying scenario.

"person has malware on their desktop PC" is a perfectly ordinary scenario. Happens to thousands of people every day.

Re: My MetaMask Private Keys Stolen from GitHub Private Repo in 1 Hour

#34

Post by hatenberg »

x86_64Ubuntu wrote: post #26
londons_explore wrote: post #9

I think your colleague cloned the repo, and he had wallet stealing malware in his PC, which probably automatically stole it within milliseconds of the clone happening.

This is a horrifying scenario.

It’s an everyday scenario in the financial world. Humans make mistakes. The systems that currently power finance may be flawed but they have affordances for mistakes and provisions to fix them.

What would be a horrifying scenario would be to lose those affordances and backstops for new technology that requires humans to not make mistakes to operate it safely

Re: My MetaMask Private Keys Stolen from GitHub Private Repo in 1 Hour

#35

Post by spzb »

Buttons840 wrote: post #27
3np wrote: post #21

I thought that at this point it’s common sense that any secret pushed to a public GitHub repo should be considered compromised, regardless of how quick you roll it back. There are many people writing automated tools doing their best to catch slip-ups like this before everyone else. Dark Forest and all that. And as someone else said, why use a wallet holding mainnet private funds as a dev wallet? Separate your keys.

> There are many people writing automated tools doing their best to catch slip-ups like this before everyone else. Dark Forest and all that. And these scripts can see my private GitHub repositories? If so, what's the difference between public and private repositories? Is this a failure of GitHub's security?

Maybe, maybe not. He admits that he shared the repo with at least one other individual. It's quite possible that what he thought was a private repo wasn't.

Re: My MetaMask Private Keys Stolen from GitHub Private Repo in 1 Hour

#36

Post by spzb »

hasangursoy wrote: post #11
Stevvo wrote: post #6

"I just emailed an invitation to my colleague that we were working together on Zoom" Most likely explanation is that if you didn't drain the wallet yourself then the only other person with access to your private key did.

He was sharing his screen when I realized the mistake, and he did not even see the keys.

On that screen, he didn't

Re: My MetaMask Private Keys Stolen from GitHub Private Repo in 1 Hour

#37

Post by mmcwilliams »

hasangursoy wrote: post #11
Stevvo wrote: post #6

"I just emailed an invitation to my colleague that we were working together on Zoom" Most likely explanation is that if you didn't drain the wallet yourself then the only other person with access to your private key did.

He was sharing his screen when I realized the mistake, and he did not even see the keys.

Was that their only screen? The simplest explanation here is that the only other person you know, even temporarily, to have your credentials used them. Another way to think about it is if you made that first mistake, maybe you made another similar one at some point?
Post reply on HN