On Wednesday, GitHub improved their code search. A few hours later, a couple of people had tried “begin rsa private key” and got more results than any sane person would anticipate. Just in case, this isn’t a problem of GitHub, the same problem can be found on pastebin or with Google.
There are several reasons for people to publish sensitive data:
- They don’t know what they’re doing (ignorance)
- They are sure “no one will ever find out” (security by obscurity)
- Distributing sensitive data anonymously (crackers)
- It’s easier that way (laziness)
It’s not a corner case, either. The SQL*Plus tool from Oracle has no easy way to set the password from a script except by passing it on the command line which effectively publishes the password to any user on the same computer. You can install a “client-side Oracle wallet” to fix this.
But the common issue behind all that is that it’s either too easy to do it wrong or too hard to do it right. Just to see how bad the situation is, I asked for a secure web login/example on stackoverflow.com. The answer was basically “it’s too complex to do.”
This sucks.
Posted by digulla 
Dark Views 