Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by buzer on Saturday April 27, 2019 @12:52AM (#19763861)

When you connect your Github account to Docker Hub, that will give DH full access to all repos (https://i.imgur.com/4jJWrez.png). I'm not even sure if Github's permission model supports adding only read access to private repositories.

I'm not 100% sure if Docker hub uses deploy keys for repos it has access to thru the integration, but at least previously there was an option to manually add one to repository if it couldn't access it otherwise.

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by rkrzr on Saturday April 27, 2019 @03:57AM (#19764422)

> I'm not even sure if Github's permission model supports adding only read access to private repositories.

Their newer GH apps permission model allows fine-grained access to only specific repos (and also only read access e.g.). However their older Oauth flow only allows full access to everything. And 99% of GH integrations still seem to use the older authentication method.

This is also something that many CI providers suffer from. There are only few that already support GH apps.

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by martinlofgren on Saturday April 27, 2019 @02:38AM (#19764172)

I tried to give an user read-only access to a private repository on GitHub a few weeks ago, and from what I could tell it isn't possible.

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by thinkmassive on Saturday April 27, 2019 @12:06PM (#19766185)

Did you look under Settings > Collaborators?

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by martinlofgren on Saturday May 04, 2019 @01:16PM (#19827789)

Yep, it's only possible to give full access there. No read only.

[ Parent | on HN ]