Hacker News Reader

Comment by drawfloat | Hacker News Reader

Other options available: ruin the company financially, violate the terms of service of whatever system it uses and get the organisation banned, access business/customer data.

If it’s that sensitive and there’s access keys accessible to anyone, it could end up much worse. Nobody said it was without inconvenience.

View on HN

This is so stupid. It’s pretty simple: malicious actors will use it to do all of those, plus now they can unilaterally bring down a system via revocation.

Non-malicious actors using it to bring down a system via revocation are therefore indistinguishable from malicious actors. It’s by definition a malicious act.

That’s why it’s a stupid idea. Non-malicious actors should just contact the company and let them take action. It’s not for an outsider to decide the impact of a leak.

Revocation of leaked keys isn't a new idea, even Github offers it as an option. It's basic practice.

I agree, but that wasn’t the point at all was it

Yes it was.

Could you point to the part where I said revocation as a principle is a bad idea? Rather than what I actually said, which was that untraceable random third parties revoking your keys without any involvement likely isn’t a good idea.

Also GitHub doesn’t revoke the keys. The providers of the key take provider-specific actions, which may or may not be revocation.

So… yeah.

That’s your opinion and plenty of people in here have pointed out they disagree. It has nothing to do with people not being serious or being unable to envision a situation where it impacts an important system.

So it indeed wasn’t the point then?

Reply on news.ycombinator.com