6 ms·
> If you are not part of the organization yet, or don't have access to a repository you should have access to, contact me at nikic@php.net with your php.net and
by aargh_aargh 6y ago
> If you are not part of the organization yet, or
don't have access to a repository you should have access to, contact me at
nikic@php.net with your php.net and GitHub account names, as well as the
permissions you're currently missing.
Migrating accounts of PHP core developers by asking them for their username over unencrypted email? What could go wrong? A security incident already occurred, so we should be good on that front for a few years, right?
- upbeat_general 6y agoAre github usernames especially sensitive?
- Sebb767 6y ago"I'm xy and had push access to the php core git server, but I do not yet have access to the PHP organization. Could you add @xyfake to it? Thanks!" Combine that with a spoofed/typo'd sender and you're good to go.
- Denvercoder9 6y agoYou can mitigate that pretty easily by checking whether recent commits from this person are linked to that GitHub account.
- Sebb767 6y agoIf the person had a GitHub account before, it could be newly created by the attacker. Or they could have had different e-mails for php.net and GitHub, i.e. something like php@xy.com and github@xy.com. In a perfect world, this would be fine, yes. But when adding work on top of a probably already very stressful workday, the likelihood of this creating additional problems is there.
- Denvercoder9 6y ago> If the person had a GitHub account before, it could be newly created by the attacker Doesn't GitHub require e-mail validation before it associates commits with that e-mail address? > Or they could have had different e-mails for php.net and GitHub, i.e. something like php@xy.com and github@xy.com. Then require them to add their php.net mail address to their GitHub account. > the likelihood of this creating additional problems is there. That I agree with.
- 1f60c 6y ago> Doesn't GitHub require e-mail validation before it associates commits with that e-mail address? IIRC, nope! You can say your email is Linus Torvalds’, and GitHub will not question it (and even link to his GitHub profile in the commit history!)
- Denvercoder9 6y ago> You can say your email is Linus Torvalds’, and GitHub will not question it (and even link to his GitHub profile in the commit history!) That's the other way around though -- claiming the victims GitHub profile made a commit controlled by the attacker, instead of claiming the attackers GitHub profile made a commit controlled by the victim.
- Sebb767 6y agoNo, you could claim the commits made by the victim this way. The steps would be: 1. Look for a contributor without GitHub account (i.e. xy@gmail.com ) 2. Add xy@gmail.com to your GitHub account/create one with that address [0] 2.1 The commits made by the victim will now link to your account on GitHub 3. Send a mail to Nikita with your faked GitHub-profile None of this will survive a thorough check, but under pressure this will easily pass a surface-level check. [0] I think you need to confirm your primary E-Mail, but not secondary ones. Alternatively, you could look for commits made from an now deleted mail account.
- JimDabell 6y ago> recent commits from this person Given that the attacker managed to push unauthorised commits, I don’t see how recent commits can be considered a reliable method of authentication.
- Denvercoder9 6y agoYou need to audit the commits anyway, and presumably after the audit they can be trusted again.
- Piskvorrr 6y agoIsn't there an existing, working PKI for this? "I'm xy and have been signing commits using the key 0xdeadbeef for some time now, signing this message with the same key." (Yes, this still has holes, but it's a far smaller attack surface than "hello, it's me, trust me because I say so".)
- Sebb767 6y agoLooking at the commit history [0], it seems that the majority of the commits aren't signed. So no, this would probably not work for identifying everyone. [0] https://github.com/php/php-src/commits/master https://github.com/php/php-src/commits/master
- nikic 6y agoFor now I'm only handling people for which I recognize the account or can confirm recent commits.
- brobdingnagians 6y agoI assume you mean that you are only handling people for whom you can confirm their recent php username AND can verify that the specific username connects to/is owned by the same person as the github account provided? Just to make sure that someone doesn't go in and find a PHP account with recent commits, then email you with a third party github account.
- johannes1234321 6y agoFor most contributors we know GitHub identities, as PHP was using pull requests etc already from GitHub.
- brobdingnagians 6y agoAah, k, makes sense :)
- radicalbyte 6y agoAre you requiring signed commits? If you're not, I strongly suggest that you do in the future.
- gocartStatue 6y agoI've been pointed out once that only tags should be signed - and referred to this: [1] https://news.ycombinator.com/item?id=12290873 https://news.ycombinator.com/item?id=12290873
- radicalbyte 6y agoThe whole part of signing commits is providing proof that you are who you say you are with the same level of trust provided by other systems built using Public Key Crypto. You need people to properly secure their keys of course, but it makes life a lot harder for an attacker.
- deleted 6y ago[deleted]