Entropy, a CLI that scans files to find high entropy lines (might be secrets)
1–10 of 141 posts
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#2[deleted]
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#3This looks like a very handy CLI tool. Nice Go code also. Thanks.
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#4This looks like a very handy CLI tool. Nice Go code also. Thanks.
thanks!
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#5GoDaddy open sourced something similar
https://github.com/godaddy/tartufo
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#6This is very cool, but I have a thought - I see this as a last line of defense, and I am concerned that this would this give a false sense of security leading people to be more reckless with secrets.
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#7Note that in an adversarial setting this will only be effective against careless opponents.
If you properly encode your secret it will have the entropy of its surroundings.
For example you can hide a string of entropy (presumably something encrypted) in text as a biased output of an LLM. To recover it you would use the same LLM and measure deviations from next-token probabilities. This will also fool humans examining it as the sentence will be coherent.
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#8See also:
- trufflehog: https://github.com/trufflesecurity/trufflehog
- detect-secrets: https://github.com/Yelp/detect-secrets
- semgrep secrets: https://semgrep.dev/products/semgrep-secrets -- (Paid, but may be included in existing licenses in some cases
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#9This is very cool, but I have a thought - I see this as a last line of defense, and I am concerned that this would this give a false sense of security leading people to be more reckless with secrets.
Ehhh considering how low the security bar is, I think it is better than nothing. If you inherit a code base, make it a quick initial action to see how much pain you can expect. In practice, I expect a tool like this has so many false positives you cannot keep it as an always running action. More a manual review you run occasionally.
I hope that more secrets adopt a GitHub like convention where they are prefaced with an identifier string so that you do not require heuristics to detect them.
Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)
#10Note that in an adversarial setting this will only be effective against careless opponents. If you properly encode your secret it will have the entropy of its surroundings. For example you can hide a string of entropy (presumably something encrypted) in text as a biased output of an LLM. To recover it you would use the same LLM and measure deviations from next-token probabilities. This will also fool humans examining…
What you described sounds like a very cool idea - LLM-driven text steganography, basically - but intentional obfuscation is not the problem this tool is trying to solve. To your point about secrets with entropy similar to the surrounding text, however, I wonder if this can pick up BIP39 Seed Phrases or if whole word entropy fades into the background.