from Hacker News

SSH Keys on GitHub

by MichaelTieso on 8/18/15, 3:40 PM with 44 comments

  • by Guyag on 8/18/15, 4:01 PM

  • by akerl_ on 8/18/15, 4:57 PM

    I feel like this gets posted every other month or so. I appreciate the awareness, but it doesn't seem like there's much new discussion or debate to have on the matter: folks continue to be a bit more careless with credentials than they ought to be / don't think about what pushing something to a public site means / etc, it would rock if GitHub was more proactive about messaging affected users, it sucks that it's hard to safeguard against this via technical means.

    If anything, I'd love to see somebody do a blog post instead about how they started scraping these results and/or the commit data firehose and messaging users who posted credentials

  • by mosburger on 8/18/15, 5:40 PM

    Hmmph. I just found a bunch of free AWS keys by searching for amazon.yml, too.

    What is the best way to share things like API keys among a team of developers, anyway? I'm surprised this hasn't been solved already (perhaps it has and I just don't know about it). I know you can share passwords with tools like LastPass and 1Password, and I suppose you could use those for API keys as well?

    It'd be nice if you could, e.g., include a gem in a Rails project, get a single key/password/token from one of the team members on that project, and use that w/ a third party API to set all the requisite API keys for all the third party services used on a project. You could also rotate the master password when team members leave the group.

  • by daenney on 8/18/15, 6:24 PM

    I see your SSH keys and raise you a .netrc: https://github.com/search?p=1&q=filename%3Anetrc&ref=searchr...

  • by bagels on 8/18/15, 3:57 PM

    Does Github have a responsibility to help people out with this kind of thing? What do you all think?

  • by jnevill on 8/18/15, 4:59 PM

    You can search out private GPG keys as well, which is crazy-bananas. https://github.com/search?utf8=%E2%9C%93&q=filename%3Aasc+BE...

  • by avinassh on 8/18/15, 5:22 PM

    And if you want to get the public key also:

    https://github.com/<username>.keys

    ex.: https://github.com/avinassh.keys

  • by geographomics on 8/18/15, 5:39 PM

    Looks like they've blocked it now. Searching via Google still works though: https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid...

  • by orbjuice on 8/18/15, 5:39 PM

    They have blocked the search for private keys (id_rsa) but they still need to block the search for public keys (id_rsa.pub); they're usually stored together anyway. I just did this search.

  • by H2CO3 on 8/18/15, 5:37 PM

    Update: This is no longer working: https://imgur.com/uT1fCRT

  • by allworknoplay on 8/18/15, 5:20 PM

    This is matching both "id" and "rsa" individually as well, so not all results are actually files with id_rsa in the name.

    Example: https://github.com/search?utf8=%E2%9C%93&q=filename%3Aid_rsa...

  • by adelevie on 8/18/15, 6:22 PM

    I'd love to see an open source project around scanning the GitHub API and subscribing to alerts for your org's repos.

  • by xiata on 8/18/15, 6:29 PM

    People always forget about the other keys...

    filename:id_ed25519 filename:id_rsa filename:id_dsa filename:id_ecdsa