4 ms·
One technique API providers could adopt is prefix all keys with a description so there's no ambiguity between keys and random base64 strings and it would make a
by trinovantes 4y ago
One technique API providers could adopt is prefix all keys with a description so there's no ambiguity between keys and random base64 strings and it would make automated checks a lot simpler: e.g. amazonsecret-... githubsecret-... donotcommit-... etc.
- FrenchyJiby 4y agoYou're definitely on to something. I know (personal) Github API tokens use a prefix of ghp_ and the Github-app JWT-issued tokens have another prefix (maybe gha_? Can't remember) As mentioned recently here on HN, a generalized version of this technique is what RFC8959[1] proposes via "secret-token" prefix. Do add these to all your pre-commit hooks and other password detectors/log analysers! [1]: https://www.rfc-editor.org/rfc/rfc8959.html https://www.rfc-editor.org/rfc/rfc8959.html
- arkadiyt 4y agoThis is precisely why github switched their token format and what they recommend other service providers do: https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/ https://github.blog/2021-04-05-behind-githubs-new-authentica...
- jdorfman 4y agoI agree, some do but more should dare I say need to follow suit.