Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tencent WeChat is now a GitHub secret scanning partner

github.blog

Post reply on HN
Print view View original

91–100 of 144 posts

Re: Tencent WeChat is now a GitHub secret scanning partner

#91

Post by mukesh610 »

ilyt wrote: post #77
AlbertVAustin wrote: post #9

Earlier quoted context omitted.

Any string that matches access token regexp provided by Tencent (see https://docs.github.com/en/developers/overview/secret-scanni... ).

So it is just one bad regexp away from sending them other companies secrets

I don't see what your comment is trying to point out.

The same could be said for all the other Secret Scanning partners GitHub has, like AWS and so on.

That being said, it's impossible that a "bad regexp" is gonna make its way to the GitHub codebase.

Re: Tencent WeChat is now a GitHub secret scanning partner

#92

Post by quadrifoliate »

trompetenaccoun wrote: post #82

To everyone portraying this as harmless and as Wechat just looking for security breaches: Tencent itself is the security breach. Not only can Chinese ppl not sign up without providing a phone number, just to get a SIM card they now take your government ID, a picture of your face and a fingerprint! Xi is making absolutely sure that every single internet user is IDed and has their conversations tracked on apps like Wec…

While Tencent and Wechat sound absolutely dystopian, the "you need a Government ID and a picture of your face" is often a requirement for creating a Facebook account or retaining your old one as well. Twitter also used to require a phone number to retain an active account; and Google frequently locks people out of old accounts unless they provide a phone.

Is this whataboutism? Possibly – but what I'd actually like to happen is US-based companies are charged company-hurting fines for mismanaging PII like this (Twitter, for example, is currently openly planning to sell user phone data [1] that they previously gathered for security purposes).

All this to say, we can't reasonably call out other dystopian companies if the ones we use everyday are doing the exact same thing. So we should call out secret scanning from Meta [2] and (if it ever happens) Twitter as well.

----------------------------------------

[1] https://www.businessinsider.com/twitter-plans-to-force-users...

[2] https://developers.facebook.com/blog/post/2021/11/09/meta-jo...

Re: Tencent WeChat is now a GitHub secret scanning partner

#93

Post by vxNsr »

sulam wrote: post #87
trompetenaccoun wrote: post #82

To everyone portraying this as harmless and as Wechat just looking for security breaches: Tencent itself is the security breach. Not only can Chinese ppl not sign up without providing a phone number, just to get a SIM card they now take your government ID, a picture of your face and a fingerprint! Xi is making absolutely sure that every single internet user is IDed and has their conversations tracked on apps like Wec…

Without taking away from your first paragraph at all, if any dissidents are publishing their access codes to GitHub repos, they are 1) doing it completely wrong and 2) are already screwed. The threat here, in the worst case, is associating a GitHub ID with a WeChat ID.

Quoted from the blog post:

> We have partnered with Tencent WeChat to scan for their tokens and help secure our mutual users on all public repositories and private repositories with GitHub Advanced Security.

This is GitHub scanning private repos and telling WeChat about them.

WeChat can already scan public repos.

They are not already screwed if they’re publishing something to a private repo, it might be the wrong way to do it, but it doesn’t mean they’re already screwed.

If you don’t trust GitHub’s private repo security then why are you using it in the first place?

Re: Tencent WeChat is now a GitHub secret scanning partner

#94

Post by b4je7d7wb »

hunter2_ wrote: post #62
pixl97 wrote: post #47

Earlier quoted context omitted.

Which information? Your wechat tokens, no that should never be public, hence why this feature exist? That github reports that you leaked your wechat tokens, it was announced just recently, hence the post. That github is giving wechat your secrets, not that is not what this is about although the article title would make you think that.

GitHub is indeed giving WeChat our information, but only when it looks just like WeChat secrets, and only once it's already publicly leaked (any leaked via private repo instead goes to the repo admin). So technically the answer to GP is 'yes'.

I dont think you can claim an API key is your information. It is quite by definition information created by WeChat and Github is sharing only that with them a few minutes before it shares it with bad actors.

Re: Tencent WeChat is now a GitHub secret scanning partner

#95

Post by vxNsr »

mmaunder wrote: post #84
andrewaylett wrote: post #5

This is part of https://docs.github.com/en/developers/overview/secret-scanni... It lets WeChat revoke tokens that GitHub finds in public repositories.

It lets WeChat see tokens that GitHub forwards to them. What they do with it is up to them, but the intent is that they mitigate the issue. “GitHub will forward access tokens found in public repositories to Tencent WeChat, who will notify affected users.”

Why did you edit the full quote?

Here’s what I just copied from the blog post without modification:

> We have partnered with Tencent WeChat to scan for their tokens and help secure our mutual users on all public repositories and private repositories with GitHub Advanced Security.

It’s not just public repos, it’s private repos too.

Re: Tencent WeChat is now a GitHub secret scanning partner

#97

Post by toastal »

nottorp wrote: post #13

Brilliant title for the article. Even though I'm a paid github customer, I had no idea they had a program called "secret scanning" and that it's actually beneficial. So I obviously assumed they're letting China scan my private repos. They really need to work on wording.

There's never been a better time to migrate your projects away from corporate control

Re: Tencent WeChat is now a GitHub secret scanning partner

#98

Post by b4je7d7wb »

whoevercares wrote: post #63

It’s absolutely shocking to observe how hostile HN is to Chinese affairs. While in real life many must have collaborated A LOT with Chinese engineers & managers. Are you worry about bias bleeding into real life? I’m indeed worried as a Chinese immigrant working in tech

It's mostly because of the government. Don't take it personally. I have quite strong opinions of China, but I don't let it influence my relationships with my chinese collegues.

Re: Tencent WeChat is now a GitHub secret scanning partner

#99

Post by oefrha »

trompetenaccoun wrote: post #82

To everyone portraying this as harmless and as Wechat just looking for security breaches: Tencent itself is the security breach. Not only can Chinese ppl not sign up without providing a phone number, just to get a SIM card they now take your government ID, a picture of your face and a fingerprint! Xi is making absolutely sure that every single internet user is IDed and has their conversations tracked on apps like Wec…

> And to the folks saying it's public information and they already have it: That makes no sense, then they don't need GitHubs help.

GitHub has a global stream API for all public events,[1] but it is delayed by five minutes, precisely so that sensitive actions like revoking leaked tokens can be performed before the world sees them. That’s what the secret scanning program is about, and you would have known if you spent 1/3 of the time of your rant learning about it.

Edit: Additionally, for private repos, secret scanning is opt-in and only alerts owners.

[1] https://docs.github.com/en/rest/activity/events?apiVersion=2...

Re: Tencent WeChat is now a GitHub secret scanning partner

#100

Post by aeyes »

trompetenaccoun wrote: post #82

To everyone portraying this as harmless and as Wechat just looking for security breaches: Tencent itself is the security breach. Not only can Chinese ppl not sign up without providing a phone number, just to get a SIM card they now take your government ID, a picture of your face and a fingerprint! Xi is making absolutely sure that every single internet user is IDed and has their conversations tracked on apps like Wec…

This is a service running on public repos, anyone can scrape this which is the problem. GitHub does the scanning and all that is forwarded is the "secret" matching their regex. Tencent then identifies the account owner and informs them about the public secret. That's all.

GitHub is available in China, why shouldn't they protect their Chinese users?

And the SIM card requirements have nothing to do with Tencent, have you tried getting a SIM in Germany? Impossible without government ID and an address. And there are a lot of services which you can't sign up for without German ID / address. As a foreigner I also can't easily open a bank account in the US.

Post reply on HN