I'm working on a web app, and I may eventually want to bring others onto the project. I have two sets of GitHub credentials: one called Foo that calls back to
foo.com/endpoint, and one called Foo -- TEST CREDENTIALS that calls back to
foo.local/endpoint. The idea is that I can share the test credentials with other developers, and they can modify their
/etc/hosts for local testing.
I'm generally a trusting person, but is there any way a malicious user could reasonably use these test credentials for evil? In my understanding, they'd have to:
- Make sure that DNS for the victim's connection to
foo.localpoints to their server.
- Ensure that the victim accesses
- Hope that the victim blindly grants access and does not notice the -- TEST CREDENTIALS in the application name on the GitHub authorization screen.
This seems fairly far-fetched to me, so I'm going to assert that it's safe to hand out these test credentials to coworkers. Can somebody prove me wrong by providing a more viable attack method?