Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by tedmiston on Saturday April 27, 2019 @07:46AM (#19765059)

You can authorize specific orgs your account has access to vs your whole account if that's what you're looking for.

Also not sure what access permissions you need but deploy keys are repo level.

https://developer.github.com/v3/guides/managing-deploy-keys/...

Machine users are another option.

https://developer.github.com/v3/guides/managing-deploy-keys/...

[ Parent | on HN ]

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by neovatar on Sunday April 28, 2019 @07:42AM (#19770579)

Seems that dockerhub is using the github oauth permissions to do three things:

- retrieve a list of all repos to display in the autobuild setup page

- setup webhooks for the gh repo that should be built via dockerhub autobuild

- setup a deploy key for said repo, so that it can be cloned

I removed the dockerhub oauth on github side, after setting up autobuild. My builds on push to master and tag are still working. So it seems possible to remove dockerhubs write access to your github repos after the autobuild setup, which really seems to be a good idea.

[ Parent | on HN ]