4 ms·
> Credentials are stored in lib/credentials.json. This is checked into the repo, so USE A PRIVATE REPO. Do not use a public fork and accidentally push your toke
by reificator 8y ago
> Credentials are stored in lib/credentials.json. This is checked into the repo, so USE A PRIVATE REPO. Do not use a public fork and accidentally push your tokens to it! I will not take responsibility for any potential leak of sensitive information.
It seems like using your CI provider to manage the credentials would be significantly more safe than checking them into even a private repository. For instance, there are several services that will scan or otherwise access your private repos for some purpose or another, and you wouldn't want to accidentally connect them while this is also in the mix.
A pre build step that templates the credentials into a file would be pretty easy to set up in most CI systems I've used, but I have no experience in CircleCI. (maybe 10 minutes of tinkering but that's it)
Finally I should note, I am not advising anyone to store their financial credentials with any third party. But if you've already made up your mind to do so, at least consider one that's meant to handle secrets in a secure manner.
- GregorStocks 8y agoIt looks like the credentials in credentials.json are your Plaid access key/secret/etc, not your bank account username/password. If an attacker gets them, they'd have read-only access to your bank account until you rotate your Plaid creds, but they wouldn't be able to do anything as simple as logging into your bank account and transferring all your money out. EDIT: It's actually worse than that, see comment from erichurkman below.
- reificator 8y agoThanks for the clarification, that's a little better. Still... EDIT: See the other response to this comment by erichurkman, this is still a potential vector for unauthorized payments, transfers, and withdrawals.
- erichurkman 8y agoCareful, because Plaid also gives you access to your account's routing and account numbers [0]. I'm not sure if the way this library works gives access to those, but with a routing & account number a thief _can_ write checks, debit your account, etc. [0] https://plaid.com/products/auth/ https://plaid.com/products/auth/
- GregorStocks 8y agoYeah, good point - I figured Auth wouldn't be enabled on a free developer account, but it looks like it actually is these days: https://plaid.com/pricing https://plaid.com/pricing.
- rflrob 8y agoAre routing and account numbers considered “secret”? Potentially any one of the handful of people I still write checks to could be unscrupulous and write checks, debit my account, etc., right?
- erichurkman 8y agoCorrect; that's why Knuth started issuing fake checks instead of real checks for people that found mistakes in his works: https://en.wikipedia.org/wiki/Knuth_reward_check https://en.wikipedia.org/wiki/Knuth_reward_check
- paulie_a 8y agoSo he started committing a felony? That doesn't seem like a great idea, interstate bank fraud gets you investigated really quickly.
- erichurkman 8y agoMore background: https://www-cs-faculty.stanford.edu/~knuth/news08.html https://www-cs-faculty.stanford.edu/~knuth/news08.html Current account 'balances' for people he no longer wrote personal checks to: https://www-cs-faculty.stanford.edu/~knuth/boss.html https://www-cs-faculty.stanford.edu/~knuth/boss.html
- paulie_a 8y agoI must be missing something but making fake checks, with fake banking information is a felony. What am I missing? The links don't explain how this criminal.
- deleted 8y ago[deleted]