News for hackers. Stuff that matters.

A comment on GitHub commit search: “remove password”. Parent comment

Re:GitHub commit search: “remove password” by olegkikin on Wednesday February 15, 2017 @09:46AM (#13652315)
But what if your codebase is used in thousands of places that you don't control? You can't always change it.

The real lesson is - don't put passwords in your code.

[ Parent | on HN ]
Re:GitHub commit search: “remove password” by tetrep on Wednesday February 15, 2017 @10:03AM (#13652437)
Don't use passwords/secrets/credentials that you can't rotate. If you've created a product in such a way that you can't rotate secrets, you have a large security issue that you should fix ASAP.

It's like someone responding to the suggestion to "use strong/unique passwords" with "but what if I don't have any authentication?"

[ Parent | on HN ]
Re:GitHub commit search: “remove password” by vbezhenar on Wednesday February 15, 2017 @09:53AM (#13652371)
Using the same password in thounsands of places isn't good either. Use unique random passwords.
[ Parent | on HN ]