This would make a good blog post. Maybe they should consider making one so we can have the article [in an easily readable/shareable/updateable form] after it's deleted from Twitter
What will happen when you commit secrets to a public Git repo?
61–68 of 68 posts
Re: What will happen when you commit secrets to a public Git repo?
#62Couldn't we come up with a standard format for secret keys, that would make it obvious they are a secret and which service they're from? This would make scanners easier to implement, and would remove the requirement to partner with GitHub to get your key format supported.
AWS uses an `AKIA` prefix for access keys (but none for secrets), SendGrid uses an `SG.` prefix on API keys, etc.
Re: What will happen when you commit secrets to a public Git repo?
#63Earlier quoted context omitted.
I think they meant it would autoinvalidate the tokens which might be valid. I think the math on an AWS secret and access key would be ridiculous to brute force.. but other types of keys might be an interesting attack vector.
If you were guessing valid tokens why would DoSing be more valuable to you than use of the token?
Bypassing rate limits and amplification, presumably. Just generate a huge list of keys and push once to attack many services at once with the whole set.
Re: What will happen when you commit secrets to a public Git repo?
#64You'll probably get an email from AWS that your account is compromised and you have 5 days to rotate your keys or your account could be terminated. Then everyday they email you to see if you made any progress rotating the keys. I made this meme about it that my boss didn't find funny. https://imgur.com/ZCUu9rr
Yes you will, but only because GitHub already recognised this class of problems and came up with their own solution [1]. Bear in mind that it works only for vendors that integrated, so while it's true for AWS it might not be for your FOO API.
I giggled at meme.
[1] https://developer.github.com/partnerships/secret-scanning/
Re: What will happen when you commit secrets to a public Git repo?
#65This would make a good blog post. Maybe they should consider making one so we can have the article [in an easily readable/shareable/updateable form] after it's deleted from Twitter
OP here. I'm planning to do so, however it will require more work (better description of the problem, wider description of viable solutions, additional case studies). Most probably it will land on Medium and Dev.to.
Re: What will happen when you commit secrets to a public Git repo?
#66Cool experiment! I PM the secret scanning team at GitHub and wanted to mention what GitHub did behind the scenes here. GitHub scans every commit to a public repo for secrets one of our secret scanning partners may have issued. We forward those candidate secrets to the issuing partner, and they take action. In some cases they auto-revoke the secret (AWS normally does this, I believe), in some cases they notify the use…
Do you also scan when a private repo is changed to public?
GitGuardian scans on every event, this includes a public event (when a Repo is made public) and will alert if secrets are found within.
Re: What will happen when you commit secrets to a public Git repo?
#67I think secret detection is great overall, but the only times I've run into it are false positives with client side API keys that are by their nature public. For example, I recently configured something to use the Google calendar API from JavaScript on the client. It's fully safe to check in this key, since it is intended to be run in client-side JavaScript anyway, but I was still nagged about it.
It's a difficult challenge. Secrets detection is probabilistic, without checking the credentials it's nearly impossible to determine, with 100% accuracy, a true vs a false positive. But it has made big improvements. What detection solutions have you been using?
Re: What will happen when you commit secrets to a public Git repo?
#68I think secret detection is great overall, but the only times I've run into it are false positives with client side API keys that are by their nature public. For example, I recently configured something to use the Google calendar API from JavaScript on the client. It's fully safe to check in this key, since it is intended to be run in client-side JavaScript anyway, but I was still nagged about it.
It's a difficult challenge. Secrets detection is probabilistic, without checking the credentials it's nearly impossible to determine, with 100% accuracy, a true vs a false positive. But it has made big improvements. What detection solutions have you been using?
I get automated emails that I didn't sign up for from GitGuardian:
"GitGuardian has detected the following Google Key exposed within your GitHub account."
My understanding was that they could use an API to check whether it was a real key, but perhaps that doesn't say whether it is a client-side or server-side key?