Thousands of images on Docker Hub leak auth secrets, private keys
bleepingcomputer.com
The result of the study can be found at https://arxiv.org/pdf/2307.03958.pdf.
You are viewing a single comment
The result of the study can be found at https://arxiv.org/pdf/2307.03958.pdf.
I’m sure plenty of the offenders are legitimate, but it’s completely safe to check private key pairs into code, or to bake them in to images. It entirely depends on what the key pairs are used for. Very common to include key pairs for development/test environments, for example. If it’s a production secret, of course you don’t do this.
You're right in one sense but when you get to the last sentence your argument breaks down.
The same type of secret should be treated the same way. The problem with treating environments different is that it builds bad habits especially for new devs who come in and see it being done in a certain way. But also, humans screw up and it's better to just build the habit of not committing anything private outside of prod-like credential stores even if it's not the prod instance.
Yeah, exactly. Don’t allow it anywhere, way less chance someone forgets to remove them from the prod build.