I too like to hardcode my AWS secret keys in my frontend application
I /have/ put other secrets into frontend code before, strictly for small temporary projects where the cost of implementing secret management outweighs the size of the project. And obviously not in code that was anywhere close to being deployed outside my own box.
Unfortunately the method outlined in the article allows access to environments that would otherwise be considered trusted and not-accessible over the internet, hence the problem
evil-server
(looks at data from client)
(recognizes well known server app)
(launches exploit!)
- you would probably only need a handful of ports
- it really only takes one person pasting that AWS key into their file to get pwned and I’m sure someone has those keys committed to GitHub right now.
- how many tabs do you have open of random tech blogs right now? Excluding HN, my guess is the average dev has at least one.
Not a super plausible attack, but over a long period of time with decent SEO, could probably deliver some interesting results.