3 ms·

I've never used Stripe, but what is the author implying here? That Stripe is leaking keys? That seems like such an outrageous claim. It's far more likely that

by keyle 2y ago

I've never used Stripe, but what is the author implying here? That Stripe is leaking keys? That seems like such an outrageous claim. It's far more likely that the team behind the said product leaked their Stripe prod key, by mistake, or through another leak (internal IT flaw, "secure" chat), than Stripe leaking random keys. I also imagine that they'd have had multiple audits making sure someone can't simply get added to their account without proper rights. The author mentions that this has happened a second time "this morning", but does not talk about ditching the key and using a new key? Does stripe not let you manage prod keys? ... [they ignored the fact that] "our API key was never leaked" Writing it in bold doesn't make it true, nor factual. I hate to say it, but without any proof and precedent, this reads like user error. I hope Stripe meets them half-way with some funds recovery options, but it's probably covered by the terms and conditions...

refulgentis 2y ago
Is having an API key a necessary condition for this?
WheatMillington 2y ago
I agree, I find it puzzling that OP can confidently say their key wasn't leaked. Unless OP themselves were the only person ever to have custody of the keys then they cannot confidently assert this.
- jillyboel 2y ago
  Even so, they could have malware on their machine without realizing it.
Aurornis 2y ago
In a later comment they claimed to have experienced a second attack after creating another key. This suggests something within their infrastructure or even their human element (developer laptops, or even people themselves) are compromised. It would be truly extraordinary if Stripe had an internal leak of keys. It’s doubtful that an internal Stripe problem would manifest as an apparently isolated sequence of attacks on a single user for a trivial sum of money (at Stripe scale). Of course, if other reports start appearing of similar issues then it’s a different story. As written, I agree: This is a sad report, but the person writing it needs to be looking internally into their systems very aggressively because the root problem is very unlikely to be coming from inside Stripe.
ndriscoll 2y ago
While it sounds likely that they leaked their key, it is also not entirely fair to characterize it as user error. Why does stripe apparently issue keys that can create new accounts, charge users, and withdraw money, and no one comments on this being abnormal? Setting up accounts should be a rare action (not something you need your application to be programmatically doing), and then they issue a scoped token that can e.g. charge your users and send the proceeds to one of those predefined accounts, refund transactions that it created, etc. and you give that to your application. Even if they have the ability to issue "do everything" tokens/keys, that should be something they hide on a corner of their UI with lots of warnings about why it's a bad idea and how scoped tokens are what you mean to use unless you really really know what you want. It shouldn't be something you accidentally walk into.

by keyle 2y ago

refulgentis 2y ago

Is having an API key a necessary condition for this?

WheatMillington 2y ago

I agree, I find it puzzling that OP can confidently say their key wasn't leaked. Unless OP themselves were the only person ever to have custody of the keys then they cannot confidently assert this.

jillyboel 2y ago
Even so, they could have malware on their machine without realizing it.

Aurornis 2y ago

In a later comment they claimed to have experienced a second attack after creating another key. This suggests something within their infrastructure or even their human element (developer laptops, or even people themselves) are compromised. It would be truly extraordinary if Stripe had an internal leak of keys. It’s doubtful that an internal Stripe problem would manifest as an apparently isolated sequence of attacks on a single user for a trivial sum of money (at Stripe scale). Of course, if other reports start appearing of similar issues then it’s a different story. As written, I agree: This is a sad report, but the person writing it needs to be looking internally into their systems very aggressively because the root problem is very unlikely to be coming from inside Stripe.

ndriscoll 2y ago

While it sounds likely that they leaked their key, it is also not entirely fair to characterize it as user error. Why does stripe apparently issue keys that can create new accounts, charge users, and withdraw money, and no one comments on this being abnormal? Setting up accounts should be a rare action (not something you need your application to be programmatically doing), and then they issue a scoped token that can e.g. charge your users and send the proceeds to one of those predefined accounts, refund transactions that it created, etc. and you give that to your application. Even if they have the ability to issue "do everything" tokens/keys, that should be something they hide on a corner of their UI with lots of warnings about why it's a bad idea and how scoped tokens are what you mean to use unless you really really know what you want. It shouldn't be something you accidentally walk into.