6 ms·

This is a very grave error. If this caused damage to open source projects then I could see a class action suit against GitHub. 1. Duty of care - should never h

This is a very grave error. If this caused damage to open source projects then I could see a class action suit against GitHub. 1. Duty of care - should never have accepted keys provably weak. 2. Poorly communicated that username.keys was available, thus many users may have thought their keys weren't at risk. 3. No countermeasures from crawlers mass collecting keys. (Not they they should even need to do this - they should just have done #1 in the first place!) This isn't a game man, GitHub hosts a ton of the world's open source code and they're supposed to be experts in cryptography and security. Russian mobsters, NATO spooks, bitcoin drug cartels, and even high school script kiddies are all constantly trying shit and it impacts us all not just the people with weak keys. If python core gets backdoored I get backdoored, no matter how careful I am with the software I install.

baby 11y ago
Instead of downvoting, let's educate people a bit more: 1. Picking a small key is all on the user. It's like choosing the single letter 'a' as a password. If you want to do so why not? 2. The key you give to github is a "public" key. It is made to be public so this should be irrelevant. 3. There is 'almost' no known countermeasures against mass crawls of public keys. Look at the recent attacks: https://blog.hboeck.de/archives/872-About-the-supposed-factoring-of-a-4096-bit-RSA-key.html https://blog.hboeck.de/archives/872-About-the-supposed-facto... What they could do: check against databases of public keys to see if your key is weakened by such attacks.
- 3pt14159 11y ago
  Edit: In response to your #1: Picking a password is all on the user too. But magically GitHub is competent enough to stop users from picking the password "ilovecake". Most users of GitHub are not security professionals. Just like most people opening a bank account are not bank vault security professionals. Original: They are downvoting me because they love / work at GitHub or don't understand how critical software security is. If you think about the physical life equivalent here (say a bank leaving keys out in the open for safe deposit boxes) there is no way to rationalize it. But all of a sudden it's our favorite social coding startup we can't actually call them out on a huge security fuck up. If this were Microsoft we'd be laughing.
  - shawabawa3 11y ago
    > But magically GitHub is competent enough to stop users from picking the password "ilovecake" That is definitely a good thing, but github wouldn't be responsible if they didn't do that and people chose weak passwords. > If you think about the physical life equivalent here (say a bank leaving keys out in the open for safe deposit boxes) there is no way to rationalize it No, it would be like a bank not actively looking for deposit box keys that customers may have dropped. btw, I 100% think github should protect users from weak keys, I'm just disagreeing that they could somehow be sued for it
    - marcos123 11y ago
      I think it is more like a bank making a diagram of the lock used on each customer's safety deposit box and posting that up on the internet. I don't see any good reason to put everyone's public key out in the open. Is there any possible way that hiding the keys would hurt github's profits?
      - Karunamon 11y ago
        That is a truly awful analogy. The entire point of PKI is that the public key is meant to be public. The impact on your security if a properly-created public key gets out is absolutely nil. I don't see any reason to hide them, save for an irrational belief that only comes from not knowing how the math works.
        schoen 11y ago
        Noted upthread: there are some noncryptographic threats about revealing the identity of anonymous users, and conceivably giving people information about which devices to steal in order to impersonate that developer. (The second is mitigated a bit by stripping the comments, but is still conceivably a source of information.)
        baby 11y ago
        How is a public key revealing your identity? You can generate as many pair as you want. If you want your identity on github to be masked just generate a key specifically for github
- Tharkun 11y ago
  I strongly disagree with #2. Your public key should NOT be public, especially without your explicit consent. Specifically because, at least theoretically, it could be used to derive your private key. From a parandoid point of view that's just Bad. This is one of the reasons why should use different key pairs for different purposes.
  - deleted 11y ago
    [deleted]
  - betenoire 11y ago
    can you suggest a better name for it then?
  - orthecreedence 11y ago
    I strongly disagree with you. So do many, many people who upload their public PGP keys to keyservers. The whole point is that anybody, anywhere can have my public key without knowing my private key. If you can derive the private key from your public key, then you have a really bad keypair (by algorithm or by keysize).
    - snowwrestler 11y ago
      Yes, but communication is the whole point of PGP. I didn't upload my PGP key to a keyserver, I uploaded SSH keys to GitHub so that I could check out my own code--code which is in a private repo. I can't think of any reason that my SSH keys should be publicly avaiable. GitHub offers private repos so I can't understand why keys are all public by default.
      - baby 11y ago
        It is because there is absolutely no reason they shouldn't be public. You can generate as many ssh key as you want and if they are long enough they are secure.
  - baby 11y ago
    I think you are talking about private keys.
jp_sc 11y ago
Nice try Sourceforge. ;) You should complain with those core commiters.

baby 11y ago

Instead of downvoting, let's educate people a bit more: 1. Picking a small key is all on the user. It's like choosing the single letter 'a' as a password. If you want to do so why not? 2. The key you give to github is a "public" key. It is made to be public so this should be irrelevant. 3. There is 'almost' no known countermeasures against mass crawls of public keys. Look at the recent attacks: https://blog.hboeck.de/archives/872-About-the-supposed-factoring-of-a-4096-bit-RSA-key.html https://blog.hboeck.de/archives/872-About-the-supposed-facto... What they could do: check against databases of public keys to see if your key is weakened by such attacks.

3pt14159 11y ago
Edit: In response to your #1: Picking a password is all on the user too. But magically GitHub is competent enough to stop users from picking the password "ilovecake". Most users of GitHub are not security professionals. Just like most people opening a bank account are not bank vault security professionals. Original: They are downvoting me because they love / work at GitHub or don't understand how critical software security is. If you think about the physical life equivalent here (say a bank leaving keys out in the open for safe deposit boxes) there is no way to rationalize it. But all of a sudden it's our favorite social coding startup we can't actually call them out on a huge security fuck up. If this were Microsoft we'd be laughing.
- shawabawa3 11y ago
  > But magically GitHub is competent enough to stop users from picking the password "ilovecake" That is definitely a good thing, but github wouldn't be responsible if they didn't do that and people chose weak passwords. > If you think about the physical life equivalent here (say a bank leaving keys out in the open for safe deposit boxes) there is no way to rationalize it No, it would be like a bank not actively looking for deposit box keys that customers may have dropped. btw, I 100% think github should protect users from weak keys, I'm just disagreeing that they could somehow be sued for it
  - marcos123 11y ago
    I think it is more like a bank making a diagram of the lock used on each customer's safety deposit box and posting that up on the internet. I don't see any good reason to put everyone's public key out in the open. Is there any possible way that hiding the keys would hurt github's profits?
    - Karunamon 11y ago
      That is a truly awful analogy. The entire point of PKI is that the public key is meant to be public. The impact on your security if a properly-created public key gets out is absolutely nil. I don't see any reason to hide them, save for an irrational belief that only comes from not knowing how the math works.
      - schoen 11y ago
        Noted upthread: there are some noncryptographic threats about revealing the identity of anonymous users, and conceivably giving people information about which devices to steal in order to impersonate that developer. (The second is mitigated a bit by stripping the comments, but is still conceivably a source of information.)
        baby 11y ago
        How is a public key revealing your identity? You can generate as many pair as you want. If you want your identity on github to be masked just generate a key specifically for github
Tharkun 11y ago
I strongly disagree with #2. Your public key should NOT be public, especially without your explicit consent. Specifically because, at least theoretically, it could be used to derive your private key. From a parandoid point of view that's just Bad. This is one of the reasons why should use different key pairs for different purposes.
- deleted 11y ago
  [deleted]
- betenoire 11y ago
  can you suggest a better name for it then?
- orthecreedence 11y ago
  I strongly disagree with you. So do many, many people who upload their public PGP keys to keyservers. The whole point is that anybody, anywhere can have my public key without knowing my private key. If you can derive the private key from your public key, then you have a really bad keypair (by algorithm or by keysize).
  - snowwrestler 11y ago
    Yes, but communication is the whole point of PGP. I didn't upload my PGP key to a keyserver, I uploaded SSH keys to GitHub so that I could check out my own code--code which is in a private repo. I can't think of any reason that my SSH keys should be publicly avaiable. GitHub offers private repos so I can't understand why keys are all public by default.
    - baby 11y ago
      It is because there is absolutely no reason they shouldn't be public. You can generate as many ssh key as you want and if they are long enough they are secure.
- baby 11y ago
  I think you are talking about private keys.

jp_sc 11y ago

Nice try Sourceforge. ;) You should complain with those core commiters.