8 ms·

Private keys committed to Github repositories

27 points by truxs 14y ago

aaronpk 14y ago
No, this is people committing their private keys to a Github repository. Github is not at fault. edit: submitter has since updated the title, was: "Github giving away your private key"
- pnathan 14y ago
  Seriously. It looks like people have added their private keys to (public!!!) repos, and voila, a search allows others to find that.
  - dhimes 14y ago
    I had a dev send me his. I guess he doesn't understand the whole key-thing. Now he doesn't log in to my server. Just sends me a zip-file that I unpack and test. sigh.
    - dhimes 14y ago
      On re-reading, I need to clarify: I asked a dev for his public key so I could give him access to my server, and he sent me his private key. Yikes!
- truxs 14y ago
  I would say it's shared responsability. Yes commiting private data is stupid, and the other hand, just testing the new sesarch by trying to search for rsa key could Have Avoided this. Anyway, as usual the main problem exist between the chair and the keyboard.
  - jamesaguilar 14y ago
    You could find these on Google (site:github.com id_rsa) before Github search, so I guess that Github search caused zero net harm.
2468ben 14y ago
Can someone just write a script that crawls this page for updates, then sends the users an email telling them what they did?
guptaneil 14y ago
.ssh should probably be on a default .gitignore list, along with .DS_Store
X-Istence 14y ago
Github is serving up private keys for those that added them to a git repository. I was wondering how they would be giving away my private key ... without me giving it to them.
orangethirty 14y ago
I hope people take the high road here and dont make an example out of github members. People make mistakes. You dont need to delete their repo to show them. A friendly email will do. Also Github, provide an option to protect those who are less security savy.
femto113 14y ago
Definitely a "you did what?" situation but probably still newsworthy since the new search tool makes the user's error easier to exploit and the publicity about the tool will make it more likely that someone will exploit it.
BuzzKilla1960 14y ago
Finally a github search that works!!!!
chadscira 14y ago
I knew this was going to happen, i'm sure other goodies will be found too.
- a_bonobo 14y ago
  Lots of people still push their Rails secret_token.rb to their GitHub-account: https://www.google.com.au/search?q=secret_token.rb+site%3Agithub.com&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:unofficial&client=firefox-a https://www.google.com.au/search?q=secret_token.rb+site%3Agi... But there is a certain probability that the token on the GitHub-page is not identical to the production site's token. (afaik, the token is digested with the user's ID and stored in the user's cookie so a user cannot change his ID while he's signed in - knowledge of the token can let you change your ID to whatever you like)
NathanKP 14y ago
Many of the items on that list are actually public keys, which should be perfectly safe to share to the world in a Git repo, but there are definitely a few private keys in there as well.
- taproot 14y ago
  And most of which are "demo app" or "assignment app" or some kind of testing /demo use key in an application that deals with ssh in its processes. There also isn't any apps above 100forks, so nothing widespread to worry about. (add forks:>100) Reminds me of google hacking: www.hackersforcharity.org/ghdb/ (which is way more fun)
bradfa 14y ago
More than half those results are public keys. It's not as bad as first impressions would indicate.
rcthompson 14y ago
I wonder if there's a case for a default pre-commit hook that greps for anything secret-looking such as ssh private keys, gpg keys, etc. and bails if it detects any.
nodesocket 14y ago
Here is how to check if you ever committed your private SSH key by accident: https://github.com/search?q=%40user-name-here+path%3A.ssh%2Fid_rsa&type=Code&ref=searchresults
kalmar 14y ago
Not just github: https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid_rsa https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid...
kbar13 14y ago
for those saying that github or git should have a default rule preventing private keys from being committed, I say: lolwat? private keys are private. these people -know- that they are pushing a git repo to a very public site. as such, they should recognize that * is going to be visible in their dotfiles repo. it's not git or github's fault that users are doin it wrong!
- guptaneil 14y ago
  That's terrible logic, akin to Apple's "the iPhone 4 isn't defective, you're just holding it wrong." If a product is confusing your users, you should improve the UX to increase its usability. Adding a default .gitignore file with some sensible defaults has no negative trade offs. If you really do want to commit your .ssh folder, just remove that line from your .gitignore. I will admit that adding .DS_Store, while convenient, might be impractical since git is meant to be platform agnostic, and they probably don't want to start adding all sorts of platform-specific files.
  - loucal 14y ago
    wait so your saying github should stick a default .gitignore file in there and bloat it just for the extremely rare case that a user commits and pushes their entire home folder? Even more rare than that is the user being dumb enough to not consider all files in the home directory before pushing to a public site. I'm sorry but I definitely agree more with the other guy's logic than yours. You say it has no negative tradeoffs? I say besides changing the whole game (as of right now github does not subject me to a single line of opinionated code) some projects are meant to be small. Sure you can just take out the github .gitignore but thats an extra step. I'm really tired of the stance that we should make development so easy even someone who refuses to RTFM can do it. I'm all against re-inventing the wheel, but dumbing things down like that is not something I can get behind.
    - guptaneil 14y ago
      I don't know about you, but I've never had a git repo that didn't have a .gitignore file. Having one automatically would make me do one less step. This doesn't dumb down programming. It improves UX for everybody, while also improving security for beginners. Why does GitHub offer to autogenerate a readme file? Because it's convenient. That doesn't dumb down programming for anybody.
troyjfarrell 14y ago
It's actually very handy to keep your private keys in a VCS (along with other dotfiles.) I keep mine in a private repository. I don't worry about it because all my private keys are encrypted with strong passphrases.
squeed 14y ago
My favorite: searching for typos. https://github.com/search?q=legnth&p=1&ref=searchbar&type=Code&l= https://github.com/search?q=legnth&p=1&ref=searchbar...
rbut 14y ago
Don't forget id_dsa as well. https://github.com/search?q=path%3A.ssh%2Fid_dsa&type=Code&ref=searchresults https://github.com/search?q=path%3A.ssh%2Fid_dsa&type=Co...
DrJ 14y ago
author should grep -v pub from the keys list.

27 points by truxs 14y ago

No, this is people committing their private keys to a Github repository. Github is not at fault. edit: submitter has since updated the title, was: "Github giving away your private key"

pnathan 14y ago
Seriously. It looks like people have added their private keys to (public!!!) repos, and voila, a search allows others to find that.
- dhimes 14y ago
  I had a dev send me his. I guess he doesn't understand the whole key-thing. Now he doesn't log in to my server. Just sends me a zip-file that I unpack and test. sigh.
  - dhimes 14y ago
    On re-reading, I need to clarify: I asked a dev for his public key so I could give him access to my server, and he sent me his private key. Yikes!
truxs 14y ago
I would say it's shared responsability. Yes commiting private data is stupid, and the other hand, just testing the new sesarch by trying to search for rsa key could Have Avoided this. Anyway, as usual the main problem exist between the chair and the keyboard.
- jamesaguilar 14y ago
  You could find these on Google (site:github.com id_rsa) before Github search, so I guess that Github search caused zero net harm.

2468ben 14y ago

Can someone just write a script that crawls this page for updates, then sends the users an email telling them what they did?

guptaneil 14y ago

.ssh should probably be on a default .gitignore list, along with .DS_Store

X-Istence 14y ago

Github is serving up private keys for those that added them to a git repository. I was wondering how they would be giving away my private key ... without me giving it to them.

orangethirty 14y ago

I hope people take the high road here and dont make an example out of github members. People make mistakes. You dont need to delete their repo to show them. A friendly email will do. Also Github, provide an option to protect those who are less security savy.

femto113 14y ago

Definitely a "you did what?" situation but probably still newsworthy since the new search tool makes the user's error easier to exploit and the publicity about the tool will make it more likely that someone will exploit it.

BuzzKilla1960 14y ago

Finally a github search that works!!!!

chadscira 14y ago

I knew this was going to happen, i'm sure other goodies will be found too.

a_bonobo 14y ago
Lots of people still push their Rails secret_token.rb to their GitHub-account: https://www.google.com.au/search?q=secret_token.rb+site%3Agithub.com&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:unofficial&client=firefox-a https://www.google.com.au/search?q=secret_token.rb+site%3Agi... But there is a certain probability that the token on the GitHub-page is not identical to the production site's token. (afaik, the token is digested with the user's ID and stored in the user's cookie so a user cannot change his ID while he's signed in - knowledge of the token can let you change your ID to whatever you like)

NathanKP 14y ago

Many of the items on that list are actually public keys, which should be perfectly safe to share to the world in a Git repo, but there are definitely a few private keys in there as well.

taproot 14y ago
And most of which are "demo app" or "assignment app" or some kind of testing /demo use key in an application that deals with ssh in its processes. There also isn't any apps above 100forks, so nothing widespread to worry about. (add forks:>100) Reminds me of google hacking: www.hackersforcharity.org/ghdb/ (which is way more fun)

bradfa 14y ago

More than half those results are public keys. It's not as bad as first impressions would indicate.

rcthompson 14y ago

I wonder if there's a case for a default pre-commit hook that greps for anything secret-looking such as ssh private keys, gpg keys, etc. and bails if it detects any.

nodesocket 14y ago

Here is how to check if you ever committed your private SSH key by accident: https://github.com/search?q=%40user-name-here+path%3A.ssh%2Fid_rsa&type=Code&ref=searchresults

kalmar 14y ago

Not just github: https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid_rsa https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid...

kbar13 14y ago

for those saying that github or git should have a default rule preventing private keys from being committed, I say: lolwat? private keys are private. these people -know- that they are pushing a git repo to a very public site. as such, they should recognize that * is going to be visible in their dotfiles repo. it's not git or github's fault that users are doin it wrong!

guptaneil 14y ago
That's terrible logic, akin to Apple's "the iPhone 4 isn't defective, you're just holding it wrong." If a product is confusing your users, you should improve the UX to increase its usability. Adding a default .gitignore file with some sensible defaults has no negative trade offs. If you really do want to commit your .ssh folder, just remove that line from your .gitignore. I will admit that adding .DS_Store, while convenient, might be impractical since git is meant to be platform agnostic, and they probably don't want to start adding all sorts of platform-specific files.
- loucal 14y ago
  wait so your saying github should stick a default .gitignore file in there and bloat it just for the extremely rare case that a user commits and pushes their entire home folder? Even more rare than that is the user being dumb enough to not consider all files in the home directory before pushing to a public site. I'm sorry but I definitely agree more with the other guy's logic than yours. You say it has no negative tradeoffs? I say besides changing the whole game (as of right now github does not subject me to a single line of opinionated code) some projects are meant to be small. Sure you can just take out the github .gitignore but thats an extra step. I'm really tired of the stance that we should make development so easy even someone who refuses to RTFM can do it. I'm all against re-inventing the wheel, but dumbing things down like that is not something I can get behind.
  - guptaneil 14y ago
    I don't know about you, but I've never had a git repo that didn't have a .gitignore file. Having one automatically would make me do one less step. This doesn't dumb down programming. It improves UX for everybody, while also improving security for beginners. Why does GitHub offer to autogenerate a readme file? Because it's convenient. That doesn't dumb down programming for anybody.

troyjfarrell 14y ago

It's actually very handy to keep your private keys in a VCS (along with other dotfiles.) I keep mine in a private repository. I don't worry about it because all my private keys are encrypted with strong passphrases.

squeed 14y ago

My favorite: searching for typos. https://github.com/search?q=legnth&p=1&ref=searchbar&type=Code&l= https://github.com/search?q=legnth&p=1&ref=searchbar...

rbut 14y ago

Don't forget id_dsa as well. https://github.com/search?q=path%3A.ssh%2Fid_dsa&type=Code&ref=searchresults https://github.com/search?q=path%3A.ssh%2Fid_dsa&type=Co...

DrJ 14y ago

author should grep -v pub from the keys list.