3 ms·
One thing to be aware of: Tools like this (and indeed, this one specifically) tend to take what I can only describe as "what AWS keys look like _now_" mentalit
by banana_giraffe 4y ago
One thing to be aware of: Tools like this (and indeed, this one specifically) tend to take what I can only describe as "what AWS keys look like _now_" mentality to how they construct regexps.
I learned this the hard way due to a script bouncing around an internal gitlab repo for ages with hardcoded AWS keys, and the second someone accidently published it to a public gist, we learned very quickly people that will abuse public AWS keys actually use AWS's recommended regexp ( https://aws.amazon.com/blogs/security/a-safer-way-to-distribute-aws-credentials-to-ec2/ https://aws.amazon.com/blogs/security/a-safer-way-to-distrib... ) to find AWS keys, even old ones, though it does result in more noise, which is no doubt why tools like this try to be more specific.
- trinovantes 4y agoOne technique API providers could adopt is prefix all keys with a description so there's no ambiguity between keys and random base64 strings and it would make automated checks a lot simpler: e.g. amazonsecret-... githubsecret-... donotcommit-... etc.
- FrenchyJiby 4y agoYou're definitely on to something. I know (personal) Github API tokens use a prefix of ghp_ and the Github-app JWT-issued tokens have another prefix (maybe gha_? Can't remember) As mentioned recently here on HN, a generalized version of this technique is what RFC8959[1] proposes via "secret-token" prefix. Do add these to all your pre-commit hooks and other password detectors/log analysers! [1]: https://www.rfc-editor.org/rfc/rfc8959.html https://www.rfc-editor.org/rfc/rfc8959.html
- arkadiyt 4y agoThis is precisely why github switched their token format and what they recommend other service providers do: https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/ https://github.blog/2021-04-05-behind-githubs-new-authentica...
- jdorfman 4y agoI agree, some do but more should dare I say need to follow suit.
- jdorfman 4y agoThis is great thanks for putting it on my radar.