Hacker News Reader

why would you do that rather than just revoking the key directly in the anthropic console?

It’s the key used by the attackers in the payload I think. So you publish it and a scanner will revoke it

oh I see, you're force-revoking someone else's key

Which is an interesting DOS attack if you can find someone's key.

The interesting thing is that (if you're an attacker) your choice of attack is DoS when you have... anything available to you.

Does this mean a program can be written to generate all possible api keys and upload to github thereby revoke everyone's access?

They are designed to be long enough that it's entirely impractical to do this. All possible is a massive number.

That's true tho... possible, but impractical.

Only possible if you are unconstrained by time and storage.

Not only you, but GitHub too, since you need to upload.

Storage is actually not much of a problem (on your end): you can just generate them on the fly.

Not possible given the amount of matter in the solar system and the amount of time before the Sun dies.