5

I'm trying to help out a new user having problems accessing their DigitalOcean Kubernetes cluster. The question didn't have enough information, so I asked them to post their configuration file.

Perhaps it's my fault? Perhaps I should have been explicit about them not posting secrets.

Anyway, it's done now -- they posted their unredacted configuration file, with their real certificate authority data and their real server name and address... There isn't enough information there to give anyone immediate access, but it would make things a lot easier for a hacker and the contents of the file would certainly be classified as highly-sensitive if not actually secret.

I've advised them to take remedial action immediately and have flagged the post to the moderators to ask if there's anything they can do to help. But, this can't be a new problem so shouldn't there be a more standard way of dealing with this sort of thing? GitHub automatically informs you if you've accidentally disclosed secrets and tries to protect you in some way. Perhaps SO should at least have a way for a high-ranked or moderator user to actually hide a post if it seems to be detrimental to the poster.

What do you think?

16
  • 10
    Mods are able to redact content from the revision history if needed, after it has been edited out of the post. (One mod does the initial redaction, another mod approves it.) See this FAQ on Meta Stack Exchange for more info: What should I do if a user posts sensitive information as part of a question or answer?
    – V2Blast
    Oct 27, 2022 at 19:35
  • 21
    Might seem silly, but bringing attention to the post in question is also not a great idea.
    – Thom A
    Oct 27, 2022 at 19:37
  • 8
    Once it's out on the internet, we can't exactly put the cat back in the bag. We can redact the post, but for credentials that can be invalidated and regenerated, there is only one correct solution: change them. Worst case, us redacting makes that less likely to happen correctly after an attacker has already copied them.
    – Ryan M Mod
    Oct 27, 2022 at 19:47
  • We also obviously aren't going to try credentials to see if they work, and we've had posters who've been alerted to posting credentials note that they were in fact fake credentials.
    – Ryan M Mod
    Oct 27, 2022 at 19:47
  • Anyway, conveniently, that question is also off-topic, so I've gone ahead and deleted it, with a comment warning the user.
    – Ryan M Mod
    Oct 27, 2022 at 19:51
  • 2
    @Larnu -- Good point, but I think that obscurity is more to the benefit of hackers. I could easily be wrong, but I'm of the opinion that the cost to the OP (who has already made the mistake) is lower than the benefits of discussing these issues publically with the community. Oct 27, 2022 at 19:55
  • 4
    My point is more that your question didn't need to include the link to the question, @SoftwareEngineer . Asking the question is fine, but you didn't need to link to the (potentially) exposed information.
    – Thom A
    Oct 27, 2022 at 19:56
  • 1
    @SoftwareEngineer I think Larnu's point is mainly that you probably shouldn't have linked to the question with the exposed credentials. Your post here seems to stand up on its own quite fine. If minimising the exposure was your goal, then including the link runs counter to it.
    – VLAZ
    Oct 27, 2022 at 19:58
  • To your point @Larnu, and to help a little I have redacted the post myself so that at least a casual user can't see the info. Oct 27, 2022 at 19:59
  • Regarding the link in the post. Again I could be wrong, but I was hoping that it would gain the attention of staff/mods who can help. I'm more worried about the amount of time the secret is exposed. Of course, once disclosed, forever disclosed, but I was thinking that a rapid response was desirable, especially if the OP doesn't know how to defend themselves (which is likely given that they've done this in the first place), or if they don't read the comments until tomorrow. As it was, a mod (Ryan M) helped quite quickly, so now the link is to a sanitised post with restricted access. Oct 27, 2022 at 20:03
  • And, surely there are no black hats on SO-Meta ;) Oct 27, 2022 at 20:04
  • 3
    And since it's linked from this meta question, I've also submitted a redaction request. (ordinarily I'd just delete the post)
    – Ryan M Mod
    Oct 27, 2022 at 20:05
  • From what I can tell there are no real secrets there. The certificate-authority-data is only supposed to contain acceptable CA certificates, and these are usually all public knowledge anyway and contain only public keys. The certificate-authority-data in that post looks hopelessly garbled anyway, but I'm not an expert on kubernetes configs. Of course real config info even without secrets is, as you note, a benefit to hackers. See also stackoverflow.com/questions/71444145/… Oct 27, 2022 at 23:41
  • I garbled it, but you could see the edit history Oct 27, 2022 at 23:49

0

Browse other questions tagged .