Intentionally Leaking AWS Keys

Re:Intentionally Leaking AWS Keys by paultopia on Tuesday January 19, 2021 @02:40PM (#25837821)

Really? If Github is already detecting credentials that reliably, I wonder why they don't just switch repositories to temporarily private and e-mail the account owner themselves...?

[ Parent | on HN ]

Re:Intentionally Leaking AWS Keys by netzvieh on Tuesday January 19, 2021 @03:03PM (#25838120)

Because the key has to be revoked on AWS side, not just removed from the repo. And probably the person pushing to Github and the person paying the AWS bill/the AWS admin are usually not the same..

[ Parent | on HN ]

Re:Intentionally Leaking AWS Keys by Znafon on Thursday January 21, 2021 @05:08AM (#25857313)

I don't think they do detection reliably, they have no idea whether it is an actual key or it could be a placeholder used as documentation for example. I don't know the details bit perhaps they just send it to AWS and AWS doesn't tell them whether it is an actual key or not?

[ Parent | on HN ]

Re:Intentionally Leaking AWS Keys by thunderrabbit on Wednesday January 20, 2021 @09:23AM (#25846734)

Or at least display a confirmation box..

[ Parent | on HN ]