Skip to content
Business School

Business School

Business Opening

Primary Menu
  • Business School
  • Advertise Here
  • Contact Us
  • Privacy Policy
  • Sitemap
  • Home
  • Saving passwords in public Trello boards is a really, really bad idea
  • finance

Saving passwords in public Trello boards is a really, really bad idea

By Magenet Magenet 3 months ago

If you put something on a publicly-accessible webpage, you should assume that it can (and eventually will) be read by another person. By that, I mean don’t put things you’d want to keep secret — like passwords and API credentials — in places where someone might eventually find them.

Sounds obvious, right? That’s because it is.

That said, one security researcher stumbled upon a troubling trend of organizations storing sensitive credentials in Trello documents, no less. An attacker could easily find these with little more than a Google query.

The researcher, Kushagra Pathak, found a veritable treasure-trove of credentials. These include usernames and passwords for emails and social media accounts, as well as stuff that’s arguably more serious, like SSH credentials, and API secrets for a variety of online services, like Amazon Web Services.

Finding these were as easy as typing into Google things like:

inurl:https://trello.com AND intext:ssh AND intext:password

Astonishingly, Pathak also encountered some organizations using public Trello boards to manage their bug bounty programs. This is worrying because they contain a list of ongoing and unresolved security issues. An adversary could use this information to easily enumerate the weaknesses within a website or system and break in. They could cause some serious damage.

Pathak told TNW he encountered 40 instances where companies were accidentally leaking credentials via public boards. Following proper ethical disclosure practices, he informed the relevant parties. Many are yet to resolve the issue though, and none have paid him a bug bounty — which is pretty stingy.

You can read the full details of the issue on Pathak’s blog post for FreeCodeCamp. It’s important to stress that this isn’t actually an issue with Trello, but rather with people improperly using the service’s public boards to store sensitive credentials.

As a wise man once said, “there’s no patch for human stupidity.”

Tags: "Georgia Business Search, American Express Business Cards, Att Business Customer Service, Att Business Internet, Att Business Login, Bad Business Codes, Bank Of America Small Business, Buffalo Business First, Business Administration Jobs, Business Administration Salary, Business Analyst Jobs, Business Card Dimensions, Business Casual Female, Business Casual For Women, Business Casual Women Outfits, Business Ideas 2021, Business Letter Example, Business License California, Business Name Search, Business Process Reengineering, Business Proposal Template, Buy A Business, Card For Business, Chase For Business, Chase Ink Business Card, Columbia Business School, Costco Business Center San Jose, Emirates Business Class, Facebook Business Account, Fictitious Business Name, Florida Business Entity Search, Ga Sos Business Search, Google Business Email, Houston Business Journal, Illinois Business Search, Instagram Business Account, Is Lularoe Still In Business, London Business School, Master Of Business Administration, Men'S Business Casual, Pittsburgh Business Times, Qualified Business Income Deduction, Sacramento Business Journal, Secured Business Credit Card, Standard Business Card Size, T Mobile Business, Texas Business Search, Tië³´o The Business, Top Business Schools In Us, Types Of Business

Continue Reading

Previous U.K. Finance Worker Pay Spikes 31% Since Start of Covid Pandemic
Next Elon Musk says Twitter accused him of violating NDA

Recent Posts

  • How Do I Choose One Of The Best Digital Shop? With Photos
  • A Preview of HubSpot’s INBOUND 2022 Conference
  • P&G cuts marketing spending in face of inflation and supply woes
  • PPC Interview Questions and Answers 2022
  • Democrat Seeks Inspector General Inquiry Into Pentagon’s Missing Jan. 6 Texts

Archives

  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • April 2022
  • March 2022
  • December 2021
  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • November 2018
  • December 2016

Categories

  • accounting
  • business
  • Business School
  • finance
  • General
  • marketing
Intellifluence Trusted Blogger

BL

TL

guestpost.buybacklinks.online/product/real-estate-guest-post 

allopurinol300mg.xyz © All rights reserved. | Magazine 7 by AF themes.