3 ms·
Er, if someone has gotten access to your secret key, aren't they already into your server? Or is this just CYA for developer incompetence?
by greghinch 14y ago
Er, if someone has gotten access to your secret key, aren't they already into your server? Or is this just CYA for developer incompetence?
- the_mitsuhiko 14y agoThat was my thinking so far in regards to this issue. I do however understand the concerns so I am probably going to evaluate a few alternatives.
- nezza-_- 14y agoLocal file inclusions are quite often very hard or impossible to exploit. Also, as linked in the blogpost, some may just pushed them online by accident, someone may lost a notebook or whatever. So no, filesystem access is only one way.
- btilly 14y agoNot necessarily. They may have gotten access to an old backup of your server. This misfeature would let them escalate that to a compromise of your live server. Attacks often involve multiple rounds of escalation as people keep on increasing their level of access. You want that escalation to be as hard as possible. Therefore you really don't want there to be a fact that could be floating around your organization in various ways that can be used to go straight to executing arbitrary code on your production site.