Categories: SecurityWorkspace

GitHub Goons Give Away Private Encryption Keys

Some coders don’t seem to have grasped the nature of public-private key encryption, publicly posting private keys on the hugely popular GitHub open source website.

Public key infrastructure (PKI), or asymmetric encryption, sees one person keep a private key, which they should never give away if they want to keep their messages secret. A public key is made available to those people who the private key owner is happy to speak to. The private key can unlock all messages sent using the encryption method, so it’s pretty important that the key is kept safe.

GitHub member gaffes

But a host of posts on GitHub contained those private keys. Even when the search function was removed from GitHub, Google searches could easily retrieve them.

The problems came to light after Stackoverflow co-founder Jeff Atwood posted a link to a search which brought up cases where PKI, purportedly secure communications were set up on GitHub, and where private keys were mistakenly revealed rather than the public one.

Sophos, a UK security firm keeping an eye on the situation, noted how many software programs actually tell users which keys are public and which are private, so mistakes such as these should not be made.

“For all the software you’re likely to use, such as OpenSSH, OpenSSL and GPG, private keys are labelled with the text PRIVATE KEY,” wrote Sophos’ Paul Ducklin, in a blog post.

“And that’s the one you’re supposed to keep private!”

Meanwhile, the GitHub search function remains down. “The search cluster has recovered, but we are keeping it offline while we perform some additional maintenance,” a message on the GitHub status page read.

How well do you know Internet security? Try our quiz and find out!

Thomas Brewster

Tom Brewster is TechWeek Europe's Security Correspondent. He has also been named BT Information Security Journalist of the Year in 2012 and 2013.

Recent Posts

UK’s CMA Readies Cloud Sector “Behavioural” Remedies – Report

Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector

5 hours ago

Former Policy Boss At X Nick Pickles, Joins Sam Altman Venture

Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…

7 hours ago

Bitcoin Rises Above $96,000 Amid Trump Optimism

Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…

9 hours ago

FTX Co-Founder Gary Wang Spared Prison

Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…

9 hours ago