Hacker News Reader

A stolen key isn't just a key to your customers' private data.

It's a key to your creditcard. Your revenue will be wiped out if you get the AWS bill after hackers booted hundreds of GPU instances under your account, moved terabytes in your data-transfer budgetm, burned tens of thousands of CPU-minutes in github actions under your creditcard, or used thousands of $s worth of tokens with your AI provider.

View on HN

It’s not a key to your credit card unless you fucked up and the key has no enforced access controls or MFA.

If you architected things correctly, your root DB key should be useless without an additional compromise of an independent system.

Depends on the key. It may be the key to the kingdom or it can be a do not care (say, for a repo with 5 suggested problems to discuss at interviews).

Obviously. It may even be a key to a no longer active account.

Naturally "a stolen key" here means that the key has access to something worth stealing. And my point was that there's far more worth stealing than your users' private data which many companies don't value that much.

Reply on news.ycombinator.com