Hacker News Reader

I hope you're enjoying being your own bank and in full control of your resources. Maybe you need to ask your bank (yourself) about your security policies. /s

(Information security is hard and you only have to make a mistake once.)

View on HN

What he is doing should have been secure. The question is valid. How were the keys exposed from a private repo?

"Secure" is kind of a relative term, it only exists with regard to a threat model and a likely spectrum of attacks. Simply having the key in plaintext on a developer PC connected to the regular internet is fairly low-security to start with; there are all sorts of opportunities for coincidental compromise that may have exposed it directly from his PC or his collaborator's PC.

Agreed, all I'm saying is that he did not give any specific detail which demonstrated a specific vulnerability. so just feel like more info is needed.

> What he is doing should have been secure.

Sure, but using any third party is inviting a layer of risk. Banks get hacked too. No system is without vulnerabilities. You decide which to trust, including your potentially error-prone self.

Reply on news.ycombinator.com