7 ms·

I have to say I'm not a huge fan of making secret theft more convenient. I don't see many positive uses for this website...

fastball 7y ago
Raise awareness that developers need to stop doing this.
- ahje 7y ago
  This. It's the same reason full disclosure works; it forces people to do better.
  - solidasparagus 7y ago
    It doesn't feel like full disclosure is really the right policy here. It almost certainly makes more sense to give the person some time to clean up the secret before publicizing the secrets.
    - akerl_ 7y ago
      Attackers can (and are) already pulling the same data sources that power this. Whether or not this site delays/obfuscates the exposed secrets, that doesn’t stop attackers.
    - eitland 7y ago
      Many people feel full disclosure is never the right policy, and if we listened to them I'm afraid we would be worse off. It has done a lot of good though even though I prefer something like project zero where vendors a given some limited time before the information gets disclosed. As for this, I'm afraid one of the first results will be that the repo services shuts down the firehose access, which I think is bad. (I think I can see a number of other ways to improve the security that would work better than that.)
      - solidasparagus 7y ago
        I should have clarified. I don't think immediate full disclosure is the right policy here. You should give people a chance to rotate the secrets before publicizing them. As the creator mentioned, most secrets are rotated quickly so it would be much more responsible to have this website run on a delay.
        eitland 7y ago
        If you force this website to run on a delay some bad guy will just hack together his own. The cat is already out and information is contagious / wants to be free.
- solidasparagus 7y ago
  Then obscure/mutate the actual secrets? Or really anything other than decreasing the barrier between would-be attackers and exposed secrets and then publicizing them on a website with very high viewership. The HN community is better than many online communities, but it's still very large and this post is almost guaranteed to lead to someone using credentials found on this website.
  - richardwhiuk 7y ago
    There are already teams out their on the internet who will scrape credentials and use them - especially public cloud keys (e.g. AWS access credentials to create Bitcoin miners).
    - solidasparagus 7y ago
      The threat models are very different. This website introduces a new set of adversaries who do not need to build infrastructure that automatically takes advantage of leaked secrets.
janikvonrotz 7y ago
The service also reports the leak to the owner automatically.
oarsinsync 7y ago
There is nothing quite like seeing your password in plain text published somewhere for the world (or some subset of the world) to see. Seeing an obscured version doesn’t have quite the same effect as the raw plain text. Nothing quite like seeing a failed login attempt for username ‘yourpassword’ emailed to the entire IT team to make you think about changing your password from your ex’s name to something distinctly less personally identifiable.
- z3t4 7y ago
  Everyone tells you that passwords are secret. You should really treat them as public records (always stored hash'ed).
- solidasparagus 7y ago
  The chances of you watching this website while your credentials unintentionally show up are essentially zero. This website is a tool for watching other peoples' secrets.
  - oarsinsync 7y ago
    This website takes a raw firehose and puts a nice human-friendly UI around it. The live data already exists in a much more machine-friendly format. If I was going to be watching other peoples' secrets for fun and profit (and not just for fun), I wouldn't be using the human-friendly version.
celticninja 7y ago
To be fair the people that would use this nefariously will already be doing something similar I am sure. This may lower the barriers to entry for others but the awareness it raises probably outdoes that risk by preventing the aforementioned nefarious users from being able to still use this sort of attacks method.

fastball 7y ago

Raise awareness that developers need to stop doing this.

ahje 7y ago
This. It's the same reason full disclosure works; it forces people to do better.
- solidasparagus 7y ago
  It doesn't feel like full disclosure is really the right policy here. It almost certainly makes more sense to give the person some time to clean up the secret before publicizing the secrets.
  - akerl_ 7y ago
    Attackers can (and are) already pulling the same data sources that power this. Whether or not this site delays/obfuscates the exposed secrets, that doesn’t stop attackers.
  - eitland 7y ago
    Many people feel full disclosure is never the right policy, and if we listened to them I'm afraid we would be worse off. It has done a lot of good though even though I prefer something like project zero where vendors a given some limited time before the information gets disclosed. As for this, I'm afraid one of the first results will be that the repo services shuts down the firehose access, which I think is bad. (I think I can see a number of other ways to improve the security that would work better than that.)
    - solidasparagus 7y ago
      I should have clarified. I don't think immediate full disclosure is the right policy here. You should give people a chance to rotate the secrets before publicizing them. As the creator mentioned, most secrets are rotated quickly so it would be much more responsible to have this website run on a delay.
      - eitland 7y ago
        If you force this website to run on a delay some bad guy will just hack together his own. The cat is already out and information is contagious / wants to be free.
solidasparagus 7y ago
Then obscure/mutate the actual secrets? Or really anything other than decreasing the barrier between would-be attackers and exposed secrets and then publicizing them on a website with very high viewership. The HN community is better than many online communities, but it's still very large and this post is almost guaranteed to lead to someone using credentials found on this website.
- richardwhiuk 7y ago
  There are already teams out their on the internet who will scrape credentials and use them - especially public cloud keys (e.g. AWS access credentials to create Bitcoin miners).
  - solidasparagus 7y ago
    The threat models are very different. This website introduces a new set of adversaries who do not need to build infrastructure that automatically takes advantage of leaked secrets.

janikvonrotz 7y ago

The service also reports the leak to the owner automatically.

oarsinsync 7y ago

There is nothing quite like seeing your password in plain text published somewhere for the world (or some subset of the world) to see. Seeing an obscured version doesn’t have quite the same effect as the raw plain text. Nothing quite like seeing a failed login attempt for username ‘yourpassword’ emailed to the entire IT team to make you think about changing your password from your ex’s name to something distinctly less personally identifiable.

z3t4 7y ago
Everyone tells you that passwords are secret. You should really treat them as public records (always stored hash'ed).
solidasparagus 7y ago
The chances of you watching this website while your credentials unintentionally show up are essentially zero. This website is a tool for watching other peoples' secrets.
- oarsinsync 7y ago
  This website takes a raw firehose and puts a nice human-friendly UI around it. The live data already exists in a much more machine-friendly format. If I was going to be watching other peoples' secrets for fun and profit (and not just for fun), I wouldn't be using the human-friendly version.

celticninja 7y ago

To be fair the people that would use this nefariously will already be doing something similar I am sure. This may lower the barriers to entry for others but the awareness it raises probably outdoes that risk by preventing the aforementioned nefarious users from being able to still use this sort of attacks method.