CircleCI trusts 8 analytics companies with your source code and API tokens

Re:CircleCI trusts 8 analytics companies with your source co... by koolba on Tuesday October 10, 2017 @11:50AM (#15442764)

> Send an email any time an API access token is created. Add a setting to allow org-wide disabling of API token creation.

I wish more apps supported this.

Also on my list is a "Don't ever let me disable 2FA" setting. I'm more worried about malicoius resets than I am about ever losing my 2FA device and backup codes.

> Add an option to delete old logs. If you have ever dumped env vars to the log file, an attacker can export these.

I surprised that secrets make it into the logs at all. I would have expected them to filter anything that's in an env secret from the log output. Pretty sure Travis does this.

> Enable subresource integrity, or serve JS from each of these companies from the CircleCI domain.

That's not much of an option for this type of thing as the third parties would then have a PITA time dealing with upgrades (so they wouldn't support it). Using <script src="hxxps://tracker.example.com/path/to/script.js"></script> (rather than a fixed version) allows for live upgrades as they're in control of the resource that is loaded.

And you can't load the script from your domain as at the end of the day it's got to get instructions and upload data to the third party. At best you'd be loading a shim that does the same thing as the script tag.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by orginal__idear on Tuesday October 10, 2017 @12:28PM (#15443089)

> "Don't ever let me disable 2FA" setting.

I like this idea. I'd only want to use this though if my Google 2FA backup codes are backed up via Authy or a similar app.

I don't trust codes I've printed out and have always lost.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by rhizome on Tuesday October 10, 2017 @12:48PM (#15443273)

Have you considered getting a safe-deposit box?

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by dabernathy89 on Tuesday October 10, 2017 @12:56PM (#15443358)

I tend to just stick all my 2FA backup codes into "secure notes" in LastPass.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by ihattendorf on Tuesday October 10, 2017 @01:16PM (#15443523)

That sort of defeats the purpose of 2FA though. Now if your LastPass database is compromised, they have access to your 2FA codes as well.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by dabernathy89 on Tuesday October 17, 2017 @03:26PM (#15494047)

True. I think it's a bit of a security compromise for convenience. Having backup codes stuck in a folder somewhere at home is only useful if I need to regain access to one of my accounts while I'm at home.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by rbranson on Tuesday October 10, 2017 @01:28PM (#15443627)

> "Don't ever let me disable 2FA" setting.

Wouldn't this be possible to circumvent if the user is allowed to switch TOTP devices? Are you saying you'd like a way to irrevocably tie this to a single TOTP secret? And you're not worried that someone could steal your TOTP secret and you'd be 100% powerless to stop them?

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by koolba on Tuesday October 10, 2017 @01:32PM (#15443667)

Perhaps I could have phrased it better. I meant don't let me disable 2FA without first authenticating using 2FA. So ignore any emails to support, 2FA reset links, secret questions, pleas for help, and anything else that would have you think that I no longer have access to my 2FA device and backup codes.

Changing devices is allowed but to do so I would authenticate using my password + 2FA prior to doing so.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by mioelnir on Tuesday October 10, 2017 @11:46PM (#15447137)

Another option would be to make it an easily abortable multi-step process with a long delay timer, ie. you disable 2FA and an abortable 3-4 day timer starts ticking with frequent reminder mails inbetween. Once the timer is done, you can confirm the deactivation.

Video games have been doing similar things for character deletion for years, yet it is rarely if ever found for account credentials in general.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by aoeusnth1 on Wednesday October 11, 2017 @06:21AM (#15448567)

Good point, this is a nice usability compromise between completely insecure, and very strict.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by AgentME on Tuesday October 10, 2017 @02:56PM (#15444373)

What happens if you lose your phone one day?

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by makapuf on Tuesday October 10, 2017 @03:07PM (#15444468)

See the comment about backup codes. You can often have some tokens just in case.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by dom0 on Tuesday October 10, 2017 @01:36PM (#15443707)

> I would have expected them to filter anything that's in an env secret from the log output. Pretty sure Travis does this.

It does.

[ Parent | on HN ]