GitHub commit search: “remove password”

Re:GitHub commit search: “remove password” by libeclipse on Wednesday February 15, 2017 @09:37AM (#13652258)

I've only ever leaked a webhook, realised minutes later, and then changed the webhook URL on the backend. It's not hard to do, and doing anything else is simply really crappy security through obscurity while hoping for the best.

[ Parent | on HN ]

Re:GitHub commit search: “remove password” by thecrazyone on Wednesday February 15, 2017 @01:18PM (#13654086)

Why would a webhook URL be a secret? Wouldn't it be more like internal API if anything?

I would assume that the parameters sent to the webhook, an auth token or something of the sort would take care of the security bit. Obscuring the URL seems like security-by-obscurity no?

[ Parent | on HN ]

Re:GitHub commit search: “remove password” by ksenzee on Wednesday February 15, 2017 @02:01PM (#13654457)

For purposes of security, there's no difference between example.com/api/my-webhook?auth-token=[some-uuid] and example.com/api/my-webhook/[some-uuid].

[ Parent | on HN ]

Re:GitHub commit search: “remove password” by olalonde on Wednesday February 15, 2017 @02:06PM (#13654508)

Not if you treat the secret URL like a password. Plus, not all webhook callers allow you to authenticate them without supplying them a special URL.

[ Parent | on HN ]