Good thing all my commit messages are "xxx"
GitHub commit search: “remove password”
81–90 of 266 posts
Re: GitHub commit search: “remove password”
#82Earlier quoted context omitted.
Still useful, means there's no point in checking any < 20, which halves the search space. Or, on the outside, can be useful to abort any attempts at bruteforce by way of cost evaluation and move on to another target.
My goal when choosing a password (generator) typically isn't "what will tie up an adversary for the longest, preventing them from moving on to attack someone else". Call me selfish, but if my password is known to be too tough to bother, so Eve moves on to someone else's weak password, great.
If you know your password is too tough to bother, then having people bash away at it is no cost to to, and benefit to everyone else.
Re: GitHub commit search: “remove password”
#83Earlier quoted context omitted.
Don't have password patterns, problem solved. Knowing that my password is 20 random characters of all possible symbols will not reduce your search space by any significant amount.
Still useful, means there's no point in checking any < 20, which halves the search space. Or, on the outside, can be useful to abort any attempts at bruteforce by way of cost evaluation and move on to another target.
Halves the search space, so in other words it only reveals 1 bit of information about the password, a completely insignificant amount. For a 64-symbol alphabet, a 20 character password is 120 bits long, so you'll still have to brute force 2^119 passwords on average. The sun will swallow the Earth before then.
Re: GitHub commit search: “remove password”
#84How do you guys, handle this problem? I use either `git-crypt` [1] or `ansible-vault` [2]. 1: https://github.com/AGWA/git-crypt 2: http://docs.ansible.com/ansible/playbooks_vault.html
Dotenv and Ansible vault, depending on the project. I also want to look into Hashicorp's Vault https://www.vaultproject.io
Re: GitHub commit search: “remove password”
#85To people like me who have done this many times in the past and want to add the file to gitignore http://stackoverflow.com/questions/1139762/ignore-files-that... The other alternative I can think of is to hide sensitive values in environment variables
Careful. If you have already committed it, and you ever push the repo to a public GH repo, your key is compromised. Just because some benevolent slacker-attackers on HN aren't sniffing the PSHB event queue, doesn't mean no one is. If you ever send the secret to Github, criminals have it. If you ever committed it, and then you ever push, then you've sent it to GitHub.
So yes, add the file to gitignore and git rm it, but also invalidate your keys and get new ones.
Re: GitHub commit search: “remove password”
#86Computers are supposed to be good at what imperfect humans are not. This only proves how primitive the tool is. That is, for example, if Gmail can ask "it looks like you forgot the attachment" why can't Git say "this is a public repo and you're about to commit and push passwords. Are you sure?" It's going to be easier to fix the tool than it is to make humans be perfect.
Good idea! Shouldn't be so hard to implement a simple prototype.
if "PASSWORD=xxx" in text => prompt alert or ask confirm
Next step would be to take this list (search result), make a curated list of 100-1000 unencrypted password (text/line + files + infos of repo), and then hard code some rules to detect +80% of cases.
Re: GitHub commit search: “remove password”
#87For anyone wondering, if you want to remove a file or secret you've already committed, you can use BFG Repo-Cleaner to go through your commit history and completely remove any trace of it.
Re: GitHub commit search: “remove password”
#88imagine private repo's :)
Re: GitHub commit search: “remove password”
#89Computers are supposed to be good at what imperfect humans are not. This only proves how primitive the tool is. That is, for example, if Gmail can ask "it looks like you forgot the attachment" why can't Git say "this is a public repo and you're about to commit and push passwords. Are you sure?" It's going to be easier to fix the tool than it is to make humans be perfect.
I don't see a need for Git or Github to do this. Would be simple enough to set up your own Git precommit hook, that can be shared if you like.
Re: GitHub commit search: “remove password”
#90For anyone wondering, if you want to remove a file or secret you've already committed, you can use BFG Repo-Cleaner to go through your commit history and completely remove any trace of it. https://rtyley.github.io/bfg-repo-cleaner/
+1. Requires Java but BFG Repo Cleaner is the only app I've ever felt worth installing the JVM for.