77

We see quite a lot of flags like:

Revision 1 contained real credentials

Up to now I've handled these by forwarding them to community managers or developers who have the power to permanently banish revisions from the database.

To be frank this strikes me as a significant waste of effort involving quite a few people and a great example of shutting the stable door after the horse has bolted. I do this currently not because it strikes me as worthwhile, but because it looks like the prevailing community opinion on what to do. I don't think I've seen that discussed anywhere explicitly though.

Personally I think the only course of action worth taking is commenting to point out to the user what they've done, with (optional) community edits. That's something that doesn't need moderator intervention so I am proposing to decline such flags with "should only be used to make moderators aware of content that requires their intervention". My reasoning is:

  1. The only safe action here is to change the credentials (everywhere they've re-used the same password too).
  2. Google usually has indexed it by the point we see the flag. Often it's in the data dumps and/or other third party sites.
  3. Deleting the revision creates a false sense of security for the person who accidentally posted the credentials.
  4. It serves as an education point for the OP - don't publish private things online, create a MCVE instead.

To be clear: I'm not proposing declining flags in cases where the OP has published PII of third parties1 (which to be frank is criminal stupidity and I'd like to see the culprits held properly accountable for, but that's a different issue).

What does the community think? Is the current process worth it?

1 Yes this really does happen, pretty much the only thing I've not seen is credit card numbers, presumably because banks are more scary than privacy commissioners.

11
  • 22
    5. It destroys the revision history, giving credit for content to users whom did not create that content. All the hassle only creates a bigger mess in the end.
    – animuson StaffMod
    Commented Dec 27, 2014 at 5:27
  • Even though the analogy with the barn is apt, there might be an argument for destroying the revision when the OP was neither the one flagging nor reached later, as he does not know about his leak. Still, that's at most a very weak argument. Commented Dec 27, 2014 at 8:26
  • I had a case where I revealed secure stuff from the OP in an answer. Although all you say is still true I would feel bad if I don't have an option to 'fix' these kind of mishaps.
    – rene
    Commented Dec 27, 2014 at 9:36
  • 1
    Even on active work days, it takes a lot of time until a revision is deleted. It is better to let the OP know so that he/she can act upon this information faster. On the other hand, how should API keys be handled? My understanding is that providers don't let the user change the API key for a web service. Is it true? Should those cases be handled differently than credentials where the password reset option is a few clicks away?
    – Artjom B.
    Commented Dec 27, 2014 at 20:44
  • 10
    @ArtjomB. I've never seen providers who don't allow revoking API keys. Sure, you can't change it and put whatever you want in place but you can request a new random one.
    – user2629998
    Commented Dec 28, 2014 at 8:05
  • 5
    @PaulCrovella oh the irony! lifehacks.stackexchange.com/questions/2221/… :p
    – Amit Joki
    Commented Dec 29, 2014 at 15:42
  • @André: How about crypto certificates? It's technically possible to revoke those, sort of, but it's a serious pain, not to mention often unreliable. Commented Dec 30, 2014 at 0:05
  • @Ilmari did someone actually was that dumb to post a certificate ? I'd say let them be, it's none of our business and if the person posted it then they deserved it, a cert isn't a small API key that you slip unnoticed in the code, a cert is a big chunk of text you just can't miss.
    – user2629998
    Commented Dec 30, 2014 at 7:38
  • 1
    please take a look at the flag I've got pending review at the moment. the user has supplied an offsite link to a 2GB SQL File to create a copy of their database. this script contains users names, postal addresses, and email addresses, potentially other info too. that was just what I noticed looking through it. Commented Dec 1, 2017 at 21:07
  • 1
    (I don't want to comment on the Q because probably most people that open it wont bother downloading it and I dont want to draw attention to it) Commented Dec 1, 2017 at 21:14
  • 2
    @martinsmith frankly I'd report them and their company to relevant authorities for prosecution/investigation. Even when the flag on here gets handled the data's still there and frankly with incompetence like that covering up for them won't stop it happening again. Commented Dec 2, 2017 at 7:10

4 Answers 4

18

I'd love to see a feature for moderators (or possibly high-rep users) to "flag" a question as "containing credentials". A moderator or enough users doing this would trigger an automated message to the creator of the question reminding him to change whatever credentials he posted as soon as possible.

Of course that message would have to be displayed in a rather prominent way. Maybe like a mod message, i.e. a yellow(?) bar on top and an email?

3
  • That may be abused (what if an idiot decides to troll by flagging all questions as containing credentials ?) so some kind of moderation is needed and that means more work for mods. I say the current system is good as is, comments work great to point out credentials.
    – user2629998
    Commented Dec 30, 2014 at 7:42
  • 1
    @AndréDaniel: All our flagging and voting systems can be abused like that. It's fairly rare, and when it does happen, the mods and staff have ways to deal with it. Commented Dec 30, 2014 at 12:30
  • @IlmariKaronen but as I said, these "credential flags" should be reviewed as well which means more moderation work.
    – user2629998
    Commented Dec 30, 2014 at 12:50
8

As Paul Crovella writes in the comments:

You can't put toothpaste back in the tube, but you can put the cap back on.

Sure, by the time someone spots the leaked credentials and alerts the mods, deleting the revision containing them is likely to be too little, too late. Still, there remains a non-zero probability that it might make a difference. It's possible that no malicious or unscrupulous person has yet noticed the leaked credentials. It's also possible that, if they're not deleted from the revision history, someone may find and exploit them before they can be changed.

In many cases, it's also plausible that, if the leaked credentials are exploited, this may also directly or indirectly harm people other than the one responsible for the leak. Given this, I feel that not promptly acting on reports of PII or unintentionally disclosed credentials in posts would be negligent and irresponsible.


Personally, the way I feel such cases should be handled would be something like this:

  • Moderators should have a way to immediately delete old revisions. Such deleted revisions should be invisible even to other moderators. SE staff should review all such deleted content to ensure that the ability is not abused, but this revision should be done after the fact.

  • When deleting old revisions containing leaked credentials, moderators should privately inform the user who posted it and advise them to change said credentials ASAP, unless it's clear that they already know this. There should be a standard boilerplate message for this.

  • Where appropriate and feasible, potentially affected third parties should be contacted too, either by moderators or by SE staff.

  • Users should be advised to deal with posts containing private credentials discreetly, by (first) flagging them for moderator attention and (then) editing the post to remove the information from the current revision. It might be useful to have a specific flag type for this, as suggested by ThiefMaster, that would place the flag at the top of the queue (and perhaps also directly notify SE staff, at least on low-volume sites where local mods may not always be around).

  • Ideally, using the revision delete feature should also automatically trigger a request for Google and other search engines to recrawl the page and remove the deleted content. Alas, Google does not seem to expose an official API for automatic outdated content removal requests, but it does occur to me that it might not hurt for SE to simply contact the folks at Google and ask for one. (Of course, SE staff with access to Google webmaster tools could do this manually, but that introduces a time delay. Fortunately, Google does seem to be pretty good at recrawling updated pages on SE sites, anyway.)

Of course, there are many kinds of private credentials, and not all are equally important or hard to revoke. Someone accidentally posting the password to their blog is not nearly as serious as, say, leaking a Sony code signing certificate. Still, we should be ready to deal with all such scenarios, and, if unsure, to err on the side of caution.

7
  • "If the leaked credentials are exploited" -- Really? You would assume that publicized credentials are still safe?
    – Matt
    Commented Dec 30, 2014 at 1:04
  • 2
    @Matt: They may be safe, or they may not be. Nobody knows. The important part is that we should aim to minimize the potential damage by a) contacting the person they belong to and telling them to change them immediately, and to assume that they may have already been misused, and also b) in the mean time, minimizing the number of people likely to see them while they are still valid. Commented Dec 30, 2014 at 1:15
  • I don't disagree with your methods in general (except for reporting to Google, there's a solid chance that removal requests show up on their transparency reports) but your assumptions are not prudent, that 1) a leaked key is still safe, and 2) that the credentials leaked are not "as serious" as a site's private key. How do you know the importance of the credentials already?
    – Matt
    Commented Dec 30, 2014 at 1:22
  • 4
    I don't; I'm saying that we need to be able to deal with any type of compromised credentials. Surely you'll agree that, the more important the credentials are, the more important it is for SE to promptly and discreetly notify their owner of the compromise. If someone accidentally posts their personal web site password on SE, we might be justified in making "an education point" out of it; if they post the admin password to their company servers handling medical / financial / classified / just plain business-critical data, surely we should not display a huge public sign pointing to it. Commented Dec 30, 2014 at 1:33
  • (As for Google, yes, they may disclose removal requests (although I think not from site owners). But they only do that after they've removed the data, and they only say e.g. that "page X was removed by request from Y"; they don't post the content that was on the page.) Commented Dec 30, 2014 at 1:35
  • 3
    That's true, the action you take depends on the importance of what was leaked. As for Google removal, I think more research is needed.
    – Matt
    Commented Dec 30, 2014 at 1:50
  • The csoonline.com/article/2857659/disaster-recovery/… link doesn't work anymore.
    – The_spider
    Commented Jul 12, 2023 at 9:20
-4

There is one point missing here, and it is a reasonable protection of the users. If someone by mistake copies real credentials (or other sensitive information) to Stack Overflow, they should of course change the credentials as soon as they find out, but also they should not be punished more than needed.

Even if no one misuses the information, and they immediately fix it (both by removing the sensitive information as well as by changing the credentials in the production system), the users still might be punished by their company just for the pure fact that it happened to them.

Stack Overflow should not serve as a platform through which our fellow programmers lose their job or have problems finding another. I don't think that the Stack Overflow mission is denouncing, or if you don't like the word, visualizing our mistakes to the whole world forever.

Hence there should be a simple mechanism (and maybe even some kind of a "right") to request removal of sensitive information from all the edit history, and do it without an unnecessary fuss.

4
  • 1
    You would hope that most people are unable to revoke or update production credentials without leaving some kind of audit trail, so the company will most likely find out regardless of what SO does, and the unfortunate poster will just have to accept the consequences. Commented Nov 27, 2020 at 15:18
  • 1
    In some production systems it is not a problem for developers to change the credentials. E.g. the system consists of microservices and the programmer posts by mistake a configuration file with credentials with which one microservice calls another. From the production system's point of view it is more or less an "implementation detail". Anyway, not regarding this, SO should not add more problems to the unfortunate poster. If SO can help by complete purge of the accidental post, it should help. Commented Nov 27, 2020 at 15:54
  • Hmm, why am I not suprised with the "acceptance" of my answer from the SO community? :( Commented Nov 27, 2020 at 15:56
  • 1
    @HonzaZidek trust me, I know from experience that getting downvoted on meta is part of writing a answer from meta.
    – 10 Rep
    Commented Nov 27, 2020 at 19:14
-5

I don't think a comment is enough.

Once it's published, the cat's out of the bag. It's too late to strip out the credentials, which creates a false sense of security, as you said.

Posting credentials is a serious offense (though usually an accident) in terms of urgency. When the mods get a flag like that, it would be ideal if they could put a yellow/orange banner next to the post, explaining that at least one revision contained credentials and that the credentials are now compromised and should be changed. This way, it would be easier for the victimized third-party (or at least the community) to notice and take action, either by reporting the leak or changing credentials. Of course, the author/editor should be notified as well.

The revision shouldn't be deleted, as it still contains context and a timestamp, which are crucial pieces of information to the party whose credentials were disclosed.

6
  • 2
    Sorry, but I'll have to -1 this. There's always a chance that no malicious person has noticed and exploited the leaked credentials yet -- your suggested banner would pretty much guarantee that someone would. This could easily cause harm to innocent third parties (such as users of a compromised web site) too. Now, if the banner was visible only to the person who posted the credentials, then I could support this (although I still would say that the revision containing the credentials should be hidden, as soon as we become aware of it). Commented Dec 29, 2014 at 23:59
  • 1
    @IlmariKaronen Doesn't matter. You can't assume that publicly-leaked credentials haven't been compromised. Period.
    – Matt
    Commented Dec 30, 2014 at 0:40
  • 2
    Of course not, but you can't just assume that they have been, either. Besides, even if they have already been compromised, why would you go around shouting "Hey, anyone else feel like breaking into this guy's server too? Here's the password!" to all the world? Commented Dec 30, 2014 at 0:54
  • 1
    No, you must assume they have been. Assuming that publicized credentials are still secret is foolish.
    – Matt
    Commented Dec 30, 2014 at 1:02
  • 3
    Perhaps a real-world analogy might communicate my point better: if you lose your credit card in a public place, even temporarily, you need to call your bank and have them block it ASAP, because someone may have found it and copied the information on it. Even so, would you really appreciate it if some helpful person found your card and decided to spread posters all over town saying "Matt XXX, you lost your credit card # 1234 5678 9012 3456, CVC 123! Please call your bank and have them block it!"? Commented Dec 30, 2014 at 1:06
  • 1
    Gee, it sure would be nice if Stack Overflow had everyone's phone number for those occasions. Besides, you can't compare losing a single physical object to a public page on the Internet that gets seen by people and crawled, archived, replicated by bots.
    – Matt
    Commented Dec 30, 2014 at 1:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .