4 ms·
My first submission on Hacker News was the link below, 2 years ago. It didn't receive any upvote. Click and see, it's fascinating. * GitHub commit search: “re
by bcaa7f3a8bbc 7y ago
My first submission on Hacker News was the link below, 2 years ago. It didn't receive any upvote.
Click and see, it's fascinating.
* GitHub commit search: “remove private key”
https://news.ycombinator.com/item?id=14262124 https://news.ycombinator.com/item?id=14262124
Although most keys removed are just useless automatically generated test keys, but genuine keys do exist. Someone should write a crawler to monitor these commits, creates digital signatures from private keys to prove the leak, and notify the CA issuer to revoke them automatically.
- jldugger 7y agoThere are multiple bots that crawl github for pubkeys and other credentials.
- bcaa7f3a8bbc 7y agoI know blackhats and grayhats must have been doing it for years. But I'm not aware there's any bot that acts in a whitehat manner to disclose it to affected parties and conduct public researches, is there? I mean, something like those RSA keys crawling projects by cryptographers that have discovered several types of non-random keys with zero security.
- jldugger 7y agoI admit I've been on the receiving side of some notices about low value API keys. https://www.gitguardian.com https://www.gitguardian.com for example, uses this sort of thing as a public service / sales lead I guess.
- bcaa7f3a8bbc 7y agoGood to know, thanks for the info.
- detaro 7y agoGithub does it themselves: https://github.blog/2018-10-17-behind-the-scenes-of-github-token-scanning/ https://github.blog/2018-10-17-behind-the-scenes-of-github-t...