Chinese dev jailed and fined for posting DJI's private keys on GitHub

Re:Chinese dev jailed and fined for posting DJI's private ke... by bcaa7f3a8bbc on Thursday May 02, 2019 @12:58PM (#19809938)

My first submission on Hacker News was the link below, 2 years ago. It didn't receive any upvote.

Click and see, it's fascinating.

* GitHub commit search: “remove private key”

https://news.ycombinator.com/item?id=14262124

Although most keys removed are just useless automatically generated test keys, but genuine keys do exist. Someone should write a crawler to monitor these commits, creates digital signatures from private keys to prove the leak, and notify the CA issuer to revoke them automatically.

[ Parent | on HN ]

Re:Chinese dev jailed and fined for posting DJI's private ke... by jldugger on Thursday May 02, 2019 @01:03PM (#19809989)

There are multiple bots that crawl github for pubkeys and other credentials.

[ Parent | on HN ]

Re:Chinese dev jailed and fined for posting DJI's private ke... by bcaa7f3a8bbc on Thursday May 02, 2019 @01:08PM (#19810041)

I know blackhats and grayhats must have been doing it for years. But I'm not aware there's any bot that acts in a whitehat manner to disclose it to affected parties and conduct public researches, is there? I mean, something like those RSA keys crawling projects by cryptographers that have discovered several types of non-random keys with zero security.

[ Parent | on HN ]

Re:Chinese dev jailed and fined for posting DJI's private ke... by jldugger on Thursday May 02, 2019 @01:14PM (#19810099)

I admit I've been on the receiving side of some notices about low value API keys. https://www.gitguardian.com for example, uses this sort of thing as a public service / sales lead I guess.

[ Parent | on HN ]

Re:Chinese dev jailed and fined for posting DJI's private ke... by bcaa7f3a8bbc on Thursday May 02, 2019 @01:15PM (#19810117)

Good to know, thanks for the info.

[ Parent | on HN ]

Re:Chinese dev jailed and fined for posting DJI's private ke... by detaro on Thursday May 02, 2019 @02:27PM (#19810974)

Github does it themselves: https://github.blog/2018-10-17-behind-the-scenes-of-github-t...

[ Parent | on HN ]