News for hackers. Stuff that matters.

A comment on GitHub commit search: “remove password”. Parent comment

Re:GitHub commit search: “remove password” by stephenr on Wednesday February 15, 2017 @11:33AM (#13653198)
You pushed your secret key, and they recognised it?

Does that imply that they are not hashing secret keys, or did you also push the account key (allowing for a single auth test on their side)?

[ Parent | on HN ]
Re:GitHub commit search: “remove password” by pyre on Wednesday February 15, 2017 @12:54PM (#13653886)
It's also possible that they just scrape the Github firehose for common patterns like

  AWS_SECRET_KEY="FOOBAR"
and send a message to the committer's email (since you presumably used a correct/valid email in the git commit).
[ Parent | on HN ]
Re:GitHub commit search: “remove password” by hughes on Wednesday February 15, 2017 @11:36AM (#13653231)
The secret key can probably be used to generate the account key.
[ Parent | on HN ]