4 ms·
I guess because then you need a registry to keep those strings unique?
by advisedwang 6y ago
I guess because then you need a registry to keep those strings unique?
- dfox 6y agoThe stated purpose is to allow detection of strings that should not be publicly disclosed. If such string would also plainly identify what it is good for it would essentially defeat the purpose. Ie. the authors want to encourage creation of automated tools that prevent disclosure of such tokens, not encourage creation of automated tools that will harvest such tokens from publicly accessible data.
- danielheath 6y agoYes, but there's also value in services automatically revoking leaked credentials, which is made easier by including such an identifier.
- remram 6y agoThe purpose is to detect secret strings in source code. If you have the source code, the purpose of the secret is easy to figure out.
- acrooks 6y agoCouldn’t you protect against that with something like com-amazon-secret-token?
- remram 6y agoUsing a domain name would have been enough, e.g. secret-token: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 vs secret-token:sendgrid.com/wQsmLe_tnOiByt8JUO4Kro.S_kyH0U2yBC54LHXoUoI4ppe3T5SFsiNmcWiu4xaVt0 Then you could even standardize that scanners should use sendgrid.com/.well-known/revoke-token to notify of secret tokens found in the wild.