5 ms·

Taken a step further, the secret should just be a URL that revokes itself - Like https://revoke.sendgrid.com/91on9SIkbUfSs https://revoke.sendgrid.com/91on9SIkb

Taken a step further, the secret should just be a URL that revokes itself - Like https://revoke.sendgrid.com/91on9SIkbUfSs https://revoke.sendgrid.com/91on9SIkbUfSs. Github should then just make a get request to every URL (can whittle abuse down a bit by requiring https://revoke.sendgrid.com/robots.txt https://revoke.sendgrid.com/robots.txt to have a Revoke: YES` section). They and anyone could maintain an allowlist of revocation URLs to pattern match as well. This makes a global registry unnecessary, and standardises the act of revocation.

scrollaway 5y ago
"Woops. I hit ctrl+enter instead of ctrl+c while copying my secret. Guess production's down for a bit while we roll new ones!" I mean your core idea is decent but that's just really funny. There's some amount of practicality being lost if your secrets start growing massively. There's also potentially restrictions to what you can put in them, and a prefix with an underscore or colon might be easier than something that has slashes in it. Your idea is probably living as a queriable dns record on the domain in question. Or a standard subdomain, or even a .well-known path.
- richthegeek 5y ago
  The alternative (as in, current reality) is "Whoops. I hit ctrl+entry while copying my secret and no-one noticed for a month. Guess all our data is leaked now!" It's also up to each provider what actually happens when the "revoke" action is triggered. Maybe they just warn you immediately, which is still better than nothing.
  - Macha 5y ago
    But if it's not a URL, Ctrl-Enter won't do anything. If it is a URL, it opens in a web browser, and now you have problems.
  - staticassertion 5y ago
    Have shorter lived secrets. Also, not sure we should be solving for the "ctrl c" of secret use case tbh.
- innomatics 5y ago
  > Woops Could require a POST or maybe even HTTP DELETE to guard against woopsies. The latter has semantic niceness about it.
teddyh 5y ago
That wouldn’t be idempotent. Also, you couldn’t send such a secret to, say, Gmail.
- sudhirj 5y ago
  It would be in that repeatedly hitting the URL will not have any effects, other than disabling them the first time. But yeah, auto-link followers will invalidate them immediately. There's a case to be made for that being a good thing, but don't want to get into that.
remram 5y ago
What I had in mind is posting them to <domain>/.well-known/report-leaked-secrets or a location looked up from the domain using DNS. Making them URLs is an interesting idea, but they are likely to look awkward (e.g. include "revoke" like your example) and get a lot of non-revocation traffic (even if we have a way to tell scanning apart from actual revocation requests, we'd probably rather only get the revocation traffic). My professional email also mangles URLs, turning them into urldefense.proofpoint.com/... Such solutions are sure to interfere with tokens looking like URLs.
franga2000 5y ago
Maybe don't let anyone delete other people's tokens, even if leaked, but automatically alerting the admin if anyone accesses the "URL" would probably be a good option.

scrollaway 5y ago

"Woops. I hit ctrl+enter instead of ctrl+c while copying my secret. Guess production's down for a bit while we roll new ones!" I mean your core idea is decent but that's just really funny. There's some amount of practicality being lost if your secrets start growing massively. There's also potentially restrictions to what you can put in them, and a prefix with an underscore or colon might be easier than something that has slashes in it. Your idea is probably living as a queriable dns record on the domain in question. Or a standard subdomain, or even a .well-known path.

richthegeek 5y ago
The alternative (as in, current reality) is "Whoops. I hit ctrl+entry while copying my secret and no-one noticed for a month. Guess all our data is leaked now!" It's also up to each provider what actually happens when the "revoke" action is triggered. Maybe they just warn you immediately, which is still better than nothing.
- Macha 5y ago
  But if it's not a URL, Ctrl-Enter won't do anything. If it is a URL, it opens in a web browser, and now you have problems.
- staticassertion 5y ago
  Have shorter lived secrets. Also, not sure we should be solving for the "ctrl c" of secret use case tbh.
innomatics 5y ago
> Woops Could require a POST or maybe even HTTP DELETE to guard against woopsies. The latter has semantic niceness about it.

teddyh 5y ago

That wouldn’t be idempotent. Also, you couldn’t send such a secret to, say, Gmail.

sudhirj 5y ago
It would be in that repeatedly hitting the URL will not have any effects, other than disabling them the first time. But yeah, auto-link followers will invalidate them immediately. There's a case to be made for that being a good thing, but don't want to get into that.

remram 5y ago

What I had in mind is posting them to <domain>/.well-known/report-leaked-secrets or a location looked up from the domain using DNS. Making them URLs is an interesting idea, but they are likely to look awkward (e.g. include "revoke" like your example) and get a lot of non-revocation traffic (even if we have a way to tell scanning apart from actual revocation requests, we'd probably rather only get the revocation traffic). My professional email also mangles URLs, turning them into urldefense.proofpoint.com/... Such solutions are sure to interfere with tokens looking like URLs.

franga2000 5y ago

Maybe don't let anyone delete other people's tokens, even if leaked, but automatically alerting the admin if anyone accesses the "URL" would probably be a good option.