Free Github SSH keys anyone?(github.com)

30 pointsby TjWallas14 anni fa19 comments

https://github.com/search?q=path%3A.ssh%2Fid_rsa

11 comments

0x014 anni fa

It'd be a useful feature for github and bitbucket to have a default pre-commit that scans for probably-sensitive files and reject commits like that (maybe with a repo setting to opt out on the website, if you think you know what you're doing)

edit: In fact, they should probably run a full search for such files now and email a heads-up to users with repos that produce hits.

vellamike14 anni fa

They might think of that as crossing a line - from just hosting and enabling you to do what you want to do to actually telling you what you want to do.

ef414 anni fa

And remember folks, just deleting the file doesn't solve the problem, because this is a version control system.

Github has published instructions on how to actually purge sensitive data that's been accidentally committed: https://help.github.com/articles/remove-sensitive-data

Wilya14 anni fa

We need a cross reference between this and Facebook graph search. For science.

(I flagged, also, because this should be told to the guys at Github, not out in the open.)

Oh, and of course, Google indexes them. Fantastic.

Kallikrates14 anni fa

I shot github an email when the feature was first released their stance is that what is out in public, is out in public.

[deleted]14 anni fa

jrochkind114 anni fa

This isn't new, presumably anyone who cared to exploit it would have already thought of:

https://www.google.com/search?q=site%3Agithub.com+inurl%3A.s...

Same thing, right?

mkhattab14 anni fa

This is a big WTF moment for me. There are a ton of private keys here. I don't even know what else to say.

vellamike14 anni fa

How exactly does this happen? I can understand that some people don't understand the need to keep their private key offline, but I would have thought those people aren't really aware of the existence of the private key...so how does it end up in a github repo?

leif14 anni fa

    $ git add .ssh
    $ git commit

mkhattab14 anni fa

It's probably more like:

   $ git add .
   $ git commit

kbar1314 anni fa

  # git add /
  # git commit -m 'omg im on the internet'

vellamike14 anni fa

Yes but what is that key doing anywhere near the repository anyway?

[deleted]14 anni fa

Kallikrates14 anni fa

Alternate source: https://www.google.com/search?q=BEGIN+RSA+PRIVATE+KEY&as...

Toddward14 anni fa

I almost can't believe someone would commit their .ssh directory to a public GitHub repo.

Seriously - why? Your public key, sure, but the entire directory?

teilo14 anni fa

In all likelihood, these are NOT the user's private SSH keys, but a key generated for the service that the user is developing - such as a key to run backups and issue remote commands. Thus I can well see that the key could be committed as part of an application stack.

mkhattab14 anni fa

No, some of these repositories are user's dotfiles. See this for example, https://github.com/gomachan/dotfiles

There are many examples like this.

gavingmiller14 anni fa

I purpose a corollary to Hanlon's razor: Never attribute to stupidity that which is adequately explained by ignorance?

kbar1314 anni fa

ignorance is almost always the explanation

ef414 anni fa

The authorized_keys and known_hosts are nice to be able to share across machines.

But of course you also want to be real careful about authenticating them (a signed tag in Git can serve that purpose).

joeycfan14 anni fa

j_s14 anni fa

It would be interesting to find out what % are password-protected.