4 ms·

fascinating stuff. I'm still amazed at how many username/passwords are freely available via github search: https://github.com/search?p=96&q=gmail+password&ref=

fascinating stuff. I'm still amazed at how many username/passwords are freely available via github search: https://github.com/search?p=96&q=gmail+password&ref=searchresults&type=Code&utf8=%E2%9C%93 https://github.com/search?p=96&q=gmail+password&ref=searchre... even if they have 2-step auth setup, people choose "complete the email address" as a form of authentication which you can most likely get from their github profile. the moral of the story here is - if you do not want someone to find it - do not publish it online

rankam 12y ago
I understand you're just showing how easy it is to find email/password combinations, but maybe it isn't the best idea to post an example link on how to do it?
- lstamour 12y ago
  Shoot. I guess I shouldn't post the advanced search I just tried. Let's just say I had 12,875 search results for a common CMS' configuration files ... it was scary how easy it was, actually, to filter the results down to what I was looking for. Github ought to put up a warning saying, "you have a wp-config.php file, you know this is public right? Here's how to use .gitignore" and a link, or something.
- misiti3780 12y ago
  all i did was search "gmail password" in github search and paste the url here - this is not rocket science
icpmacdo 12y ago
Im not a hacker/cracker or whatever but I am curious would it be illegal to use one of those usernames and passwords to see if it actually worked for an account? edit: I know that it is not ethical and I am only slightly tempted to do it but is it actually illegal to use open source code in that way?
- IkmoIkmo 12y ago
  Depends on the jurisdiction, but generally yes it'd be illegal. You can compare it to opening someone's home because he left his key in a public place unbeknownst to him. You generally couldn't make the argument that 'he may have wanted people to have the key, that's why he left it in a public/open source place'. Firstly, one can't assume that, so we must hear it explicitly before it's true. And secondly, if universal open-source access was provided, there wouldn't be a key to find as there wouldn't be a lock in the first place to allow specific access. The whole point of a password or key means you do not want fully open access to all, meaning any password or key in an open-source project is likely unintentional, a mistake, and thus you'd be entering without permission which is illegal in most jurisdictions.
- lstamour 12y ago
  I'd say this crosses the line, in a day and age where using CURL can land jail time (e.g. AT&T "leak"). Guessing a password doesn't legally grant you the right to enter a server, either. That'd be like saying you had a right to trespass because someone left the gate open or didn't build it high enough. It doesn't work that way. I really think Github needs better protections for this. Consider a search for "export GITHUB_SECRET" ;-)
IkmoIkmo 12y ago
Yeah it's crazy. Just last week I caught myself just in time. I was developing an API for this website and was testing the user login with my own credentials which I saved in a variable so I wouldn't have to retype it all the time as I tested API login functions. I finished some things and pressed the 'commit' button (commit plugin in Brackets ftw) but cancelled it when I realized I was committing an admin credential to a public repository. The next step would've been to push it. Reminds me of a story where a hosted bitcoin wallet was open-sourced right after they shut down. It was completely uploaded to github, including credentials that indirectly allowed access to an exchange where they stored a lot of their funds. It was a stupid company ran by careless people in the first place (they got hacked 2-3 times before open-sourcing an API key that was the same as a LastPass password that held their exchange password). About $350k was stolen. ($14 million by today's standards.)
- misiti3780 12y ago
  what company was that ?
  - mifreewil 12y ago
    Sounds like Bitcoinica (https://en.bitcoin.it/wiki/Bitcoinica https://en.bitcoin.it/wiki/Bitcoinica)
  - IkmoIkmo 12y ago
    http://bitcoinmagazine.com/1805/bitcoinica-stolen-from-again/ http://bitcoinmagazine.com/1805/bitcoinica-stolen-from-again...
deleted 12y ago
[deleted]
theswan 12y ago
Equally interesting/appalling: private keys on github https://github.com/search?p=4&q=extension%3A.key+BEGIN+RSA+PRIVATE+KEY+size%3A%22%3E+300%22&ref=searchresults&type=Code&utf8=%E2%9C%93 https://github.com/search?p=4&q=extension%3A.key+BEGIN+RSA+P...
zerr 12y ago
Maybe someone could come up with a script to notify all those users?
ryanjshaw 12y ago
The password mentioned in the post is also there: https://github.com/Dao007forever/Linux-settings/blob/master/.bashrc#L360 https://github.com/Dao007forever/Linux-settings/blob/master/... https://github.com/Dao007forever/Linux-settings/blob/master/.bashrc#L361 https://github.com/Dao007forever/Linux-settings/blob/master/... https://github.com/Dao007forever/Linux-settings/blob/master/.bashrc#L441 https://github.com/Dao007forever/Linux-settings/blob/master/... > the moral of the story here is - if you do not want someone to find it - do not publish it online I doubt it's intentional. I will note that on Windows, if you're using ActiveDirectory, it's much more difficult to make this kind of mistake.

rankam 12y ago

I understand you're just showing how easy it is to find email/password combinations, but maybe it isn't the best idea to post an example link on how to do it?

lstamour 12y ago
Shoot. I guess I shouldn't post the advanced search I just tried. Let's just say I had 12,875 search results for a common CMS' configuration files ... it was scary how easy it was, actually, to filter the results down to what I was looking for. Github ought to put up a warning saying, "you have a wp-config.php file, you know this is public right? Here's how to use .gitignore" and a link, or something.
misiti3780 12y ago
all i did was search "gmail password" in github search and paste the url here - this is not rocket science

icpmacdo 12y ago

Im not a hacker/cracker or whatever but I am curious would it be illegal to use one of those usernames and passwords to see if it actually worked for an account? edit: I know that it is not ethical and I am only slightly tempted to do it but is it actually illegal to use open source code in that way?

IkmoIkmo 12y ago
Depends on the jurisdiction, but generally yes it'd be illegal. You can compare it to opening someone's home because he left his key in a public place unbeknownst to him. You generally couldn't make the argument that 'he may have wanted people to have the key, that's why he left it in a public/open source place'. Firstly, one can't assume that, so we must hear it explicitly before it's true. And secondly, if universal open-source access was provided, there wouldn't be a key to find as there wouldn't be a lock in the first place to allow specific access. The whole point of a password or key means you do not want fully open access to all, meaning any password or key in an open-source project is likely unintentional, a mistake, and thus you'd be entering without permission which is illegal in most jurisdictions.
lstamour 12y ago
I'd say this crosses the line, in a day and age where using CURL can land jail time (e.g. AT&T "leak"). Guessing a password doesn't legally grant you the right to enter a server, either. That'd be like saying you had a right to trespass because someone left the gate open or didn't build it high enough. It doesn't work that way. I really think Github needs better protections for this. Consider a search for "export GITHUB_SECRET" ;-)

IkmoIkmo 12y ago

Yeah it's crazy. Just last week I caught myself just in time. I was developing an API for this website and was testing the user login with my own credentials which I saved in a variable so I wouldn't have to retype it all the time as I tested API login functions. I finished some things and pressed the 'commit' button (commit plugin in Brackets ftw) but cancelled it when I realized I was committing an admin credential to a public repository. The next step would've been to push it. Reminds me of a story where a hosted bitcoin wallet was open-sourced right after they shut down. It was completely uploaded to github, including credentials that indirectly allowed access to an exchange where they stored a lot of their funds. It was a stupid company ran by careless people in the first place (they got hacked 2-3 times before open-sourcing an API key that was the same as a LastPass password that held their exchange password). About $350k was stolen. ($14 million by today's standards.)

misiti3780 12y ago
what company was that ?
- mifreewil 12y ago
  Sounds like Bitcoinica (https://en.bitcoin.it/wiki/Bitcoinica https://en.bitcoin.it/wiki/Bitcoinica)
- IkmoIkmo 12y ago
  http://bitcoinmagazine.com/1805/bitcoinica-stolen-from-again/ http://bitcoinmagazine.com/1805/bitcoinica-stolen-from-again...

deleted 12y ago

[deleted]

theswan 12y ago

Equally interesting/appalling: private keys on github https://github.com/search?p=4&q=extension%3A.key+BEGIN+RSA+PRIVATE+KEY+size%3A%22%3E+300%22&ref=searchresults&type=Code&utf8=%E2%9C%93 https://github.com/search?p=4&q=extension%3A.key+BEGIN+RSA+P...

zerr 12y ago

Maybe someone could come up with a script to notify all those users?

ryanjshaw 12y ago

The password mentioned in the post is also there: https://github.com/Dao007forever/Linux-settings/blob/master/.bashrc#L360 https://github.com/Dao007forever/Linux-settings/blob/master/... https://github.com/Dao007forever/Linux-settings/blob/master/.bashrc#L361 https://github.com/Dao007forever/Linux-settings/blob/master/... https://github.com/Dao007forever/Linux-settings/blob/master/.bashrc#L441 https://github.com/Dao007forever/Linux-settings/blob/master/... > the moral of the story here is - if you do not want someone to find it - do not publish it online I doubt it's intentional. I will note that on Windows, if you're using ActiveDirectory, it's much more difficult to make this kind of mistake.