5 ms·
It's incredibly disappointing actually how often this happens. I can't count the amount of SO questions I've had to edit from others posting live API Keys for
by bilekas 4y ago
It's incredibly disappointing actually how often this happens.
I can't count the amount of SO questions I've had to edit from others posting live API Keys for everything from custom services to AWS.
- swimfar 4y agoWhen you do this is there a way to completely get rid of the information? Usually you can go back an look at the edit history to see the original post.
- bilekas 4y agoYeah mods can clear the review history - for this very reason! But as mentioned below - Still advised to change your keys for obvious reasons
- aembleton 4y agoChange the keys.
- capableweb 4y agoWouldn't matter. Tons of bots are scraping every inch of the internet all the time, and if something been online for five seconds, it has been cached/stored somewhere. Always assume that anything you've put up on the internet, can forever be accessed by someone. The only thing you can do is rotating the token/secret.
- teddyh 4y agohttp://www.threepanelsoul.com/comic/on-that-guy http://www.threepanelsoul.com/comic/on-that-guy
- TecoAndJix 4y agoI wonder if you could make a luhn-like check that would require an additional approval step to post if it comes back positive. Something like "It looks like you may be posting a secret *****. Do you wish to continue?
- bilekas 4y agoI was thinking about that too, but it's actually tricky, even the example given, they use the var `accessId` but you could filter for all that, even the standard ones, but you couldn't have enough confidence in it so that if someone did post with a typo or even a random var name, they would think "Okay, no warning so must be okay". Something like giving false confidence to the user. Not the best idea.
- jewel 4y agoIf vendors agreed to a common prefix on all secret key values then it'd be easy for everyone to add checks, to everything. Something like "_SECRET88_". Of course, then your secret key checker would need to build that string by concatenating so that it wouldn't set off itself.
- zricethezav 4y agoMore and more providers have been adding unique prefixes to their tokens and access keys which makes detection much easier. Ex, GitLab adds `glpat-` to their PAT. A project I maintain, Gitleaks, can easily detect "unique" secrets and does a pretty good job at detecting "generic" secrets too. In this case, the generic gitleaks rule would have caught the secrets [1]. You can see the full rule definition here [2] and how the rule is constructed here [3]. [1] https://regex101.com/r/CLg9TK/1 https://regex101.com/r/CLg9TK/1 [2] https://github.com/zricethezav/gitleaks/blob/master/config/gitleaks.toml#L1139-L1147 https://github.com/zricethezav/gitleaks/blob/master/config/g... [3] https://github.com/zricethezav/gitleaks/blob/master/cmd/generate/config/rules/generic.go https://github.com/zricethezav/gitleaks/blob/master/cmd/gene...
- pitched 4y agoHow about scanning for any string with high entropy? Might be easier to get buy-in if we don’t all have to bike-shed over what the prefix is.
- CoffeeOnWrite 4y agoThat’s helpful but the token prefixes are also helpful. You might be interested in GitHub’s reasoning at https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/ https://github.blog/2021-04-05-behind-githubs-new-authentica...
- segudev 4y agoIndeed, last year we detected on average 84 AWS IAM creds for every 10k commits pushed to GitHub https://res.cloudinary.com/da8kiytlc/image/upload/v1646148528/GitGuardian_StateOfSecretsSprawl2022.pdf https://res.cloudinary.com/da8kiytlc/image/upload/v164614852...