3 ms·
Exposed secret keys is not a technological problem, not really. It doesn't belong to the category of problems you solve with automated decision making. I leave
by loa_in_ 2y ago
Exposed secret keys is not a technological problem, not really. It doesn't belong to the category of problems you solve with automated decision making. I leave it to the reader to imagine how automated decision making would play out here.
But they should accept feedback about exposed secret keys through some way where a responsible person in company could act on it.
- Ukv 2y ago> I leave it to the reader to imagine how automated decision making would play out here Could you elaborate? Many other services have automated revocation, either through scanning for exposed keys or offering an endpoint to submit keys to, and as far as I can tell the way it has played out is in successful warning of and prevention of many leaks. I don't see how lack of it can be justified as a "security" measure.
- loa_in_ 2y agoIMO it's going to result in a potential DoS by submitting guesses en masse, denying whole revoking whole company's access until key renewal.
- Ukv 2y agoKeys should have sufficient bits of entropy to not be guessable. And if a malicious actor can guess a key, you should want it revoked as opposed to them doing more serious damage through other endpoints.