Comment by drawfloat
4 hours ago
Given they found a secret key in a public place? No that’s not malicious and it would be odd for a serious organisation to be upset someone immediately invalidated it.
4 hours ago
Given they found a secret key in a public place? No that’s not malicious and it would be odd for a serious organisation to be upset someone immediately invalidated it.
Are you really unable to imagine a situation where financial or physical harm is caused by a system abruptly being shut down by a credential revocation, triggered by a random person on the internet?
Be serious.
Is that system made by a supervillain or a mad scientist? But such system can go amok for any reason. Anyway revocation is already possible by publication on github, telling to GPT or sending an email to webmaster.
Credentials published on GitHub are not automatically revoked - what happens is at the discretion of the provider, for precisely this reason.
For example AWS applies a “quarantine” policy that prevents some specific actions[1].
Allowing anyone to report a potentially compromised key is one thing, but allowing anyone to unilaterally revoke a token is another.
1. https://docs.aws.amazon.com/aws-managed-policy/latest/refere...