30

I've been on the Suggested Edits review queue for the past few days, and I keep seeing this exact same edit summary word-for-word:

I've removed the API key from the post for security and privacy concerns.

They all come from users with <1k reputation and are all Google Maps API keys from questions tagged with .

It all just seems too suspicious, almost as if there are bots scanning the site for Google Maps API keys. I can understand removing API keys and using a similar edit summary every time, but they are all exactly the same with correct capitalization. For example, take a look at this one user. The user has made a large number of edits with the same exact summary.

The aforementioned user definitely isn't just a bot; they have made some non-edit actions, but they could be running some kind of bot on the side. I'm not sure if running a bot goes against some terms of service or something, but it just seems suspicious. What should we do, if anything?

Also, I have seen multiple accounts use the exact same wording, not just this one user. This might be a coincidence, but here's an example: Suggested Edit.

9
  • 41
    Users are totally permitted to run bots which edit posts (of course that user has to take responsibility for whatever actions their automated program makes). I'm sure this has been discussed before (we've definitely seen users making significant numbers of automated edits) but I haven't been able to locate a thread atm. Also, this is the second post (now deleted) (that I'm aware of) about the user specifically referenced.
    – Henry Ecker Mod
    Commented Oct 12, 2022 at 0:59
  • Wouldn't just rejected the edits eventually cause them to be edit banned or are edit bans only come after a failed audit? Commented Oct 12, 2022 at 4:34
  • 6
    Regarding your edit: That is the same user you linked to earlier in your question.
    – BSMP
    Commented Oct 12, 2022 at 5:21
  • 2
    Looking at the numerous rejected edits and approved, they are all removing the same API key, so this user is clearly targeting this specific key. Just reject the edit(s) problem will eventually solve itself Commented Oct 12, 2022 at 6:39
  • 9
    Suggested edit descriptions are cached in the description box so you actually only have to type something fully one time. For subsequent edits, you then just need to start typing a few letters and it'll show as an auto-complete option for you to click.
    – TylerH
    Commented Oct 12, 2022 at 13:05
  • @SecurityHound look again. I sampled 19 edits from page 3 of @Yrll (the editor)'s edits, and 17 of the removed keys were unique. The keys do all have a common prefix "AIzaSy". Also, like BSMP said, I've only seen Yrll doing these edits (one user- not multiple).
    – starball
    Commented Oct 13, 2022 at 1:02
  • 4
    I opened a chat with Yrll and got the impression that they were acting out of good intentions. They mentioned that it was "part of their job". I didn't press for more information. I collaborated with them to flag their edits for mods to redact the edit history out of good, uninformed intentions and was pointed to this and taught in general to just tell the post author to cycle their API key instead of flagging for redaction unless the post is really good.
    – starball
    Commented Oct 13, 2022 at 1:03
  • 4
    I'll just confirm it here that it was not a bot. All of the edits were done by me manually.
    – Yrll
    Commented Oct 13, 2022 at 3:58
  • 4
    Here's a chatroom with @david-fong where we had a conversion about what I did. and somehow there's details there about why I do it.
    – Yrll
    Commented Oct 13, 2022 at 4:01

3 Answers 3

69

I'll just confirm it here that it was not a bot. All of the edits were done by me manually. And the edits I did were all Google Maps API keys.

Here's the query I used to search: Stack Overflow Maps API key Janitorial Query

It might look like that I was editing out the same API Key but I was just actually looking through all API keys that starts with AIzaSy*.

Reason why I was doing it

Some developers could post their Maps API keys when they ask or answer a Google Maps question while unrestricted, as per API security Best Practice. And this causes their unrestricted API keys to be casually available to the public.

Although I believe that everyone should be entitled to secure their own API keys, and it would be them who will lose money, letting them be would lead them to file a billing adjustment case to the Maps Technical Support Team. That's why I'm trying to filter them out on Stack Overflow before they file a case so that the Maps Technical Support Team could focus on other more important cases.

I had discussions on chat with people here and was advised to be careful on my edits because it causes unneeded bumps on questions.

As I'm fairly new on Stack Overflow, I would greatly appreciate feedback from this community as to how I could do better for this community and also for those who are using Google Maps Products.

10
  • 28
    I have gone through some of your edits and I noticed that you just removed the API key without fixing other issues in the post... please try to fix all issues in the post before submitting the edit for review... for example here, you didn't fix the unnecessary capitalization in the post... and here you didn't remove the "I appreciate all the support, greetings." part and so on... Please go through How do I make a good edit? once... thanks
    – Sabito
    Commented Oct 13, 2022 at 9:13
  • 21
    I should note that other users have been noticing your edits and flagging them for redaction. Edits remove them from the visible post, but they can still be viewed in the revision history. For instance this edit you made has been redacted out of the original post. Your edit was useful to point out what needed removal, and now the key cannot be seen anymore (hence why your edit appears empty). Edit and flag, and we can take it from there.
    – Machavity Mod
    Commented Oct 13, 2022 at 15:05
  • 55
    If you are intending to flag for redaction, then it's better to have an edit revision which makes only the redaction changes and not fix everything. Changing only what needs redaction makes it much easier for moderators to know exactly what needs redaction. If we have to dig it out of a bunch of other changes at the same time, it can sometimes be unclear exactly what needs to be redacted. Under almost all circumstances, edits, particularly suggested edits, should fix everything, but when intending to ask for redaction, it's better to focus just on those changes.
    – Makyen Mod
    Commented Oct 13, 2022 at 15:59
  • 2
    Really appreciate all these feedback! Regarding the flagging for redaction, We were doing it before but we got banned from flagging after our flags got rejected multiple times with a message linking us to here: security.stackexchange.com/a/82977/283712. I believe the other users who helped in flagging got banned from flagging too.
    – Yrll
    Commented Oct 13, 2022 at 23:25
  • 3
    One day, when you get enough reputation, your edits won't need to be reviewed. You'll still need to be careful, and you should follow the feedback. Manual edits should fix other problems in the Q&A. Maybe you should answer some questions or perhaps ask some. Commented Oct 13, 2022 at 23:30
  • 3
    @Makyen and Machavity, (it was me helping with the flags) It's interesting that you both seem ok with the redaction request flags. Ryan M told me that it's not really the correct solution and that the correct solution is to tell the poster to cycle their API key (link). I agree. I think now that we know the purpose is to prevent accidental billing mishaps instead of for security and privacy, it's not useful to redact the edit history. That's my current thought anyway. Maybe I'll see/learn something new that changes my mind.
    – starball
    Commented Oct 14, 2022 at 4:16
  • 6
    @david-fong We're OK with the redaction flags, because redaction does help in many cases. Being OK with such flags doesn't mean it's the best solution. Once some private information, such as an API key, is posted, it's out in the world and there isn't any way to get it back to being fully private. The right solution for things that can be changed, such as API keys, is for the user to invalidate the key and use a new API key, which they, hopefully, have learned not to post indiscriminately. If the information can't be changed, then redaction is the best we can do.
    – Makyen Mod
    Commented Oct 14, 2022 at 4:52
  • In addition to what @Makyen just said, the edit history of a post is also still fully available, so anyone can easily go and have a peek at the original version of the post.
    – Lundin
    Commented Oct 14, 2022 at 10:30
  • 1
    @Yrll - Just to expand on a different part of what Makyen said, there's a number of sites out there which basically just scrape and re-show content from SO. If any of them grabbed the key while it was visible, even redacting it here doesn't help. Maybe have a [feature-request] to detect an API key in a post before the user makes it in the first place and warn them? There's an old one asking to block it that was denied, but I think the "new question quality" checks are newer than that, so a warning might be doable.
    – Bobson
    Commented Oct 14, 2022 at 15:15
  • @Bobson, yeah I was thinking that redacting old posts with their API keys could not help because some might have copied and pasted it somewhere already. So maybe I was thinking of just monitoring new ones and editing them out before they get compromised.
    – Yrll
    Commented Oct 15, 2022 at 2:55
52

I do not have enough evidence that this user is running a bot.

  • Did not submit multiple suggested edits within a short time frame
  • Did not submit a suggested edit to remove an API key almost as soon as the question was posted
  • Did not perform other actions (like leaving a comment or posting an answer) at the same time (+/-2s) when the suggested edits were submitted
  • There is no pattern in the timestamps of the suggested edits (i.e.: submitted exactly at the same second every minute)

The exact same suggested edit comments are probably just a copy-paste.

11
  • 55
    It's also probable that the exactly the same edit comments are just browser input completion. Depending on the browser and settings, the browser will retain the values which were used in inputs like edit comments and offer the entries which the user previously used as completion options, should the user choose to select one.
    – Makyen Mod
    Commented Oct 12, 2022 at 3:01
  • 14
    Can we send them a message that editing these posts are basically useless? This post explains why they're editing out information and causing edit queues for something that's basically not needed. Half of these edits are for API keys which are in HTML code...so they're not exactly sensitive information.
    – Blue
    Commented Oct 12, 2022 at 4:09
  • 10
    @Blue We could reject them, because you're right, they're not sensitive. Instead people are approving them which just encourages it. Commented Oct 12, 2022 at 4:14
  • @Blue I'm not sure why you believe more communications from mods is necessary as they apparently already messaged the user (according to link to the previous post on the same subject). What exactly you'd like to add? Commented Oct 12, 2022 at 5:15
  • 3
    @AlexeiLevenkov - Nothing, but perhaps the other question, shouldn’t be deleted? Commented Oct 12, 2022 at 6:42
  • @SecurityHound "deleted 20 hours ago by the post author." - so not much should be really done... except agreeing with you that perhaps the author should not have done that (like in many cases of quick self-deletion of questions). Commented Oct 12, 2022 at 6:59
  • 1
    FWIW It's also just... not that difficult to use correct spelling and punctuation for the same short sentence, over and over, so that it is the exact same every time.
    – TylerH
    Commented Oct 12, 2022 at 13:04
  • 9
    @AlexeiLevenkov the user making the suggested edits has not received a moderator message regarding these edits.
    – Ryan M Mod
    Commented Oct 12, 2022 at 18:25
  • 1
    Both Yrll and I were pointed to security.stackexchange.com/a/82977/283712 via the messages on our declined flags to redact the edit history. We know about that post now. I'm not sure why Yrll is still suggesting these edits though.
    – starball
    Commented Oct 13, 2022 at 1:06
  • 2
    @Blue that same answer explains that overuse of the API key could cause billing issues for the owner of the API key. If it's present in a lot of posts, then people copy-pasting could be causing problems for the key's owner.
    – TarHalda
    Commented Oct 13, 2022 at 14:21
  • 3
    @david-fong I still think there's value in removing the keys from questions here. While malicious actors can still steal keys from websites/apps, removing them from code here prevents clueless copypasters from using someone else's key out of ignorance. I suspect the latter group is far larger than the former. Commented Oct 13, 2022 at 21:58
10

While API are not secrets, the number of times this API key has appeared seems to potentially cause problems for inattentive developers that reuse it. Overall, I am not against it. If there's a key that you must modify, making you having to verify the code you are copy-n-pasting is a good balance.

2
  • 1
    See my comment here. The edits are not all for the exact same API key. They're all google-maps API keys, but they are not the same keys (same type, not same value).
    – starball
    Commented Oct 13, 2022 at 1:08
  • 3
    @david-fong the later part still is applicable. If it's something that you should specify yourself, then the post shouldn't provide you with one. See here for an example of that
    – Braiam
    Commented Oct 13, 2022 at 1:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .