ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by no_wizard on Thursday July 12, 2018 @12:57PM (#17516483)

Perhaps. Though I find that the statistical odds of an ssh key being breached is smaller than spoofing web credentials, thought I could be wrong, my background is not in security. Just anecdotally I actually haven't met anyone that has had their SSH keys hacked/stolen/compromised but I know lots and lots of people, even smart people who use 2 factor for everything, have had something compromised (though I can vividly remember one case where it was 2 factor that saved the day from one of my co-workers having a very nasty identity theft problem. Remember folks, don't ever save a note in your email with your SSN and Drivers License)

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by cphoover on Thursday July 12, 2018 @01:24PM (#17516744)

an ssh key is just a file on your computer the same way they stole the ~/.npmrc file. They could just as easily steal your ~/.ssh/id_rsa private key.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by no_wizard on Thursday July 12, 2018 @11:41PM (#17520367)

Sure this is true. Though the audience of folks that would 1.know what an ssh key is and 2. Know how to generate one I would put better than average odds in on the ssh key not being compromised than any internet account particularly if it does not have 2fa enabled

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by Celarnor on Thursday July 12, 2018 @02:06PM (#17517120)

This is why your SSH key has no business being in the filesystem and should instead be on a hardware token where all the crypto/signing operations happen on the HW token's chip.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by cesarb on Thursday July 12, 2018 @02:00PM (#17517069)

That file is often encrypted with a password, so it's not that trivial.

[ Parent | on HN ]