7 ms·
SSH Keys on GitHub
- bagels 11y agoDoes Github have a responsibility to help people out with this kind of thing? What do you all think?
- grhmc 11y agoNo. There are valid cases to upload SSH keys and other certificates or secrets. Preventing it would be annoying, and near impossible to be very effective. Just my $0.02.
- jethro_tell 11y agoI agree with you, but I can't imagine a use case for a secret that's not secret.
- swozey 11y agoThey could be pointing to an environment variable or a number of things. I'm not sure if there's a good way for Github to deal with things like that without affecting at least some users. edit:..I guess they could just validate that it's a key.
- benjarrell 11y agoThere probably aren't many, howto and examples come to mind.
- mikegirouard 11y agoI believe Vagrant uses (or previously used) an insecure, public keypair[0] to keep things simple. Aside from things like that, I can't see it being a _common_ use case. [0]: https://github.com/mitchellh/vagrant/tree/master/keys https://github.com/mitchellh/vagrant/tree/master/keys
- jvoorhis 11y agoCertificates are not secrets.
- sluzorz 11y agoI don't think they remove it. I do believe that they send an automated email if they detect private keys from being committed to a public repo though. Amazon does something similar to this and they even revoke the key if they see that its public.
- stephenhuey 11y agoAmazon does help with it. A friend of mine recently went through a newbie programmer class and forgot the teacher instructed them to keep their AWS SSH keys out of their repo and within a 20-hour period someone racked up tens of thousands of dollars in EC2 charges! Amazon kindly refunded the entire bill.
- nightmiles 11y agoIt would be really cool if Github let users know when they are about to do something that is almost certainly a horrible mistake. However, is it their responsibility to stop them? I hope not. They provide a service that does exactly what it says on the box. Github shouldn't be obligated to prevent people from committing files that are otherwise valid and legal. A better question would be: Could Github be successfully found liable for other users leaving their own keys in a public repository?
- nodesocket 11y agoResponsibility? No, why would they. But.... I think it would be a great feature for GitHub to passively scan repos and look for common security oversights. They could then just send an e-mail notification about the issue.
- ams6110 11y agoNo, once they start screening content they take on liability. I'm surprised they've done as much as they have e.g. with the "retarded" controversy.
- 0x0 11y agoI think it would be very useful for repositories to have a default server-side push hook that scans for the most common mistakes, rejecting the push while printing an URL to a page explaining what's going on and with a checkbox for opting out on the check for future pushes to that repo.
- Guyag 11y agoPersonal favourite https://github.com/valeriangalliat/dotfiles/blob/b227cf9b252f3c8c43a776bc20e1f1b5d0acfc13/src/ssh/id_rsa https://github.com/valeriangalliat/dotfiles/blob/b227cf9b252...
- deleted 11y ago[deleted]
- akerl_ 11y agoI feel like this gets posted every other month or so. I appreciate the awareness, but it doesn't seem like there's much new discussion or debate to have on the matter: folks continue to be a bit more careless with credentials than they ought to be / don't think about what pushing something to a public site means / etc, it would rock if GitHub was more proactive about messaging affected users, it sucks that it's hard to safeguard against this via technical means. If anything, I'd love to see somebody do a blog post instead about how they started scraping these results and/or the commit data firehose and messaging users who posted credentials
- __abc 11y agoYou want to be arrested as a "cyber terrorist"? Because that's how you get arrested as a "cyber terrorist" :)
- herge 11y agoWasn't that the point of lulzsec?
- peterwwillis 11y agoIan Paul of PC World wrote that, "As its name suggests, LulzSec claims to be interested in mocking and embarrassing companies by exposing security flaws rather than stealing data for criminal purposes."[16] -- https://en.wikipedia.org/wiki/LulzSec https://en.wikipedia.org/wiki/LulzSec
- jnevill 11y agoYou can search out private GPG keys as well, which is crazy-bananas. https://github.com/search?utf8=%E2%9C%93&q=filename%3Aasc+BEGIN+PGP+PRIVATE+KEY+BLOCK&type=Code&ref=searchresults https://github.com/search?utf8=%E2%9C%93&q=filename%3Aasc+BE...
- Kenji 11y agoSo much for no forward secrecy :D
- allworknoplay 11y agoThis is matching both "id" and "rsa" individually as well, so not all results are actually files with id_rsa in the name. Example: https://github.com/search?utf8=%E2%9C%93&q=filename%3Aid_rsa+whatever&type=Code&ref=searchresults https://github.com/search?utf8=%E2%9C%93&q=filename%3Aid_rsa...
- avinassh 11y agoAnd if you want to get the public key also: https://github.com/<username>.keys https://github.com/<username>.keys ex.: https://github.com/avinassh.keys https://github.com/avinassh.keys
- bradleyland 11y agoNo need. You can recover the public key from a private key using ssh-keygen's 'y' option: -y This option will read a private OpenSSH format file and print an OpenSSH public key to stdout. For example: ssh-keygen -y -f id_rsa > id_rsa.pub
- H2CO3 11y agoUpdate: This is no longer working: https://imgur.com/uT1fCRT https://imgur.com/uT1fCRT
- iamroot 11y agoadding wildcards works, eg: id_rsa?
- orbjuice 11y agoThey have blocked the search for private keys (id_rsa) but they still need to block the search for public keys (id_rsa.pub); they're usually stored together anyway. I just did this search.
- netik 11y agoI don't think they've blocked it. I can still search on id_rsa without issue. However, The majority of the keys I'm seeing are either encrypted, test fixtures, or otherwise. There are many unencrypted keys available, though! It's still surprising that people continue to check in private keys. No one learns.
- geographomics 11y agoLooks like they've blocked it now. Searching via Google still works though: https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid_rsa https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid...
- peterwwillis 11y agoid_rsa is being blocked right now, but id_dsa and id_ecdsa still work.
- iamroot 11y agoadding wildcards works as well, eg: id_rsa?
- eykanal 11y agoNot entirely, do the same search and only subset on "text" type (not Javascript, C++, PHP...). I was able to browse through quite a few id_rsa files.
- mosburger 11y agoHmmph. I just found a bunch of free AWS keys by searching for amazon.yml, too. What is the best way to share things like API keys among a team of developers, anyway? I'm surprised this hasn't been solved already (perhaps it has and I just don't know about it). I know you can share passwords with tools like LastPass and 1Password, and I suppose you could use those for API keys as well? It'd be nice if you could, e.g., include a gem in a Rails project, get a single key/password/token from one of the team members on that project, and use that w/ a third party API to set all the requisite API keys for all the third party services used on a project. You could also rotate the master password when team members leave the group.
- idunno246 11y agofor AWS...dont use access tokens/secrets, and just use instance profiles(theres a few mock metadata service projects). For other things, theres a bunch of services like hashicorp's vault or amazon kms that store passwords. kms + instance roles gets you fairly close, but its not really friendly to set up
- Nacraile 11y agoFWIW, Amazon proactively scans GitHub for AWS key leaks, notifies the account holder, and flags the account (they will disable the account if they start seeing active abuse and can't get in touch with the actual owner to get keys rotated). So any keys you find are going to get invalidated in short order. They're also pretty good about forgiving the charges for the fraudulent use. > What is the best way to share things like API keys among a team of developers, anyway? I'm surprised this hasn't been solved already (perhaps it has and I just don't know about it). I know you can share passwords with tools like LastPass and 1Password, and I suppose you could use those for API keys as well? Here, we have an IAM account for each dev. Permissions are basically read anything except a few sensitive things (billing, IAM), plus the write permissions we need as operators. We each have our own console login password, and keep our own access keys locally. It's pretty easy to add/remove accounts for new/departing devs, and the potential to individualize permissions is there.
- Couto 11y agoI'm not sure if there are other ways, better or not... but blackbox[1] can be used to store secrets. And it might be possible to achieve some success with git filters[2], at least to avoid pushing secrets into the repository. Still... just my two cents, I'm not exactly a pro-user of those two features [1](https://github.com/StackExchange/blackbox https://github.com/StackExchange/blackbox) [2](https://stackoverflow.com/questions/6557467/can-git-ignore-a-specific-line https://stackoverflow.com/questions/6557467/can-git-ignore-a...)
- adelevie 11y agoI'd love to see an open source project around scanning the GitHub API and subscribing to alerts for your org's repos.
- daenney 11y agoI see your SSH keys and raise you a .netrc: https://github.com/search?p=1&q=filename%3Anetrc&ref=searchresults&type=Code&utf8= https://github.com/search?p=1&q=filename%3Anetrc&ref=searchr...
- xiata 11y agoPeople always forget about the other keys... filename:id_ed25519 filename:id_rsa filename:id_dsa filename:id_ecdsa