4 ms·
Isn't this exactly what he explained? The user has a easy toggle on their dashboard to rotate credentials - and if he needs a hand with it, contact their suppor
by patrickbolle 8y ago
Isn't this exactly what he explained? The user has a easy toggle on their dashboard to rotate credentials - and if he needs a hand with it, contact their support for some help.
- detaro 8y agoI think the parents question was why they wait for the customer to do something instead of blocking/rotating the compromised credentials once they became aware of their existence. E.g. I remember reading that Amazon even scans Github for AWS credentials proactively now, since this happened all the time.
- badestrand 8y agoObviously they don't want to break their customer's production system without asking.
- e12e 8y agoTrue. It should be in the TOS that exposed api keys are subject to being revoked to prevent abuse. At least for certain services, and certain types of tokens.