undefined | Better HN

0 pointsmingus884mo ago0 comments

It’s the key used by the attackers in the payload I think. So you publish it and a scanner will revoke it

0 comments

oh I see, you're force-revoking someone else's key

Which is an interesting DOS attack if you can find someone's key.

The interesting thing is that (if you're an attacker) your choice of attack is DoS when you have... anything available to you.

Does this mean a program can be written to generate all possible api keys and upload to github thereby revoke everyone's access?

They are designed to be long enough that it's entirely impractical to do this. All possible is a massive number.

That's true tho... possible, but impractical.

j / k navigate · click thread line to collapse