Driftwood: Know if private keys are sensitive
trufflesecurity.com
Driftwood: Know if private keys are sensitive
1–10 of 23 posts
Re: Driftwood: Know if private keys are sensitive
#2This was flagged and marked dead at https://news.ycombinator.com/item?id=29152572
Which is a shame, thanks for resubmitting
Re: Driftwood: Know if private keys are sensitive
#3Why are there so many private keys in repos? It seems preferable to just generate them when needed instead of risk one being misused
Re: Driftwood: Know if private keys are sensitive
#4Why are there so many private keys in repos? It seems preferable to just generate them when needed instead of risk one being misused
Committing private keys is definitely the wrong thing to do. But if the system is talking to something, then generating new keys won’t help either. What you need is some kind of system to deploy or retrieve secrets. There are various different solutions that exist for this.
Re: Driftwood: Know if private keys are sensitive
#5Why are there so many private keys in repos? It seems preferable to just generate them when needed instead of risk one being misused
Most private keys in Git repositories seem to be test data. But why are those test private keys sometimes used for other things? Probably just people lazily copying from ~/.ssh/idrsa or copying to ~/.ssh/idrsa.
Re: Driftwood: Know if private keys are sensitive
#6Why are there so many private keys in repos? It seems preferable to just generate them when needed instead of risk one being misused
Most private keys in Git repositories seem to be test data. But why are those test private keys sometimes used for other things? Probably just people lazily copying from ~/.ssh/idrsa or copying to ~/.ssh/idrsa.
Private keys for tests should be generated on demand, lest you induce CI failure due to key expiration some years down the line
Re: Driftwood: Know if private keys are sensitive
#7I'm sorry, what?! All private keys are sensitve.
Please be more spesific.
Re: Driftwood: Know if private keys are sensitive
#8I'm sorry, what?! All private keys are sensitve. Please be more spesific.
If you search GitHub, you can find ~4M results for PEM private keys: https://github.com/search?q=PRIVATE+KEY-----&type=Code
Many are for tests and don't go to anything. Some go to really important things though, even among the test keys, and this tool tells you that instantly for billions of keys.
Re: Driftwood: Know if private keys are sensitive
#9Oh this is interesting. Often bug bounty’s claim a published private key wasn’t in use or sensitive. This gives researchers the ability to call BS on that.
Re: Driftwood: Know if private keys are sensitive
#10Earlier quoted context omitted.
Most private keys in Git repositories seem to be test data. But why are those test private keys sometimes used for other things? Probably just people lazily copying from ~/.ssh/idrsa or copying to ~/.ssh/idrsa.
Private keys for tests should be generated on demand, lest you induce CI failure due to key expiration some years down the line
I'm somewhat surprised how many keygen type tools don't support ways to do that without putting a passphrase on a command line. Gpg is nice, with --passphrase-fd.