3

I'm working on a web app, and I may eventually want to bring others onto the project. I have two sets of GitHub credentials: one called Foo that calls back to foo.com/endpoint, and one called Foo -- TEST CREDENTIALS that calls back to foo.local/endpoint. The idea is that I can share the test credentials with other developers, and they can modify their /etc/hosts for local testing.

I'm generally a trusting person, but is there any way a malicious user could reasonably use these test credentials for evil? In my understanding, they'd have to:

  1. Make sure that DNS for the victim's connection to foo.local points to their server.
  2. Ensure that the victim accesses foo.local instead of foo.com.
  3. Hope that the victim blindly grants access and does not notice the -- TEST CREDENTIALS in the application name on the GitHub authorization screen.

This seems fairly far-fetched to me, so I'm going to assert that it's safe to hand out these test credentials to coworkers. Can somebody prove me wrong by providing a more viable attack method?

Improve this question
2
  • 1
    1. What exactly are your test credentials protecting? 2. Why would an attacker even need to have the test credentials to mount the phishing attack you described?
    – Gudradain
    Commented Oct 20, 2015 at 18:27
  • With the test credentials, the user would be authorized via our org's GitHub account (and not the attacker's). Although, presumably, they could much more easily create an org with the same display name and logo. You make a good point; your comment is good material for a "not unless OAuth is horribly broken, which it's not" answer :)
    – Ryan Kennedy
    Commented Oct 20, 2015 at 19:06

1 Answer 1

Reset to default
1

It's a perfectly reasonable use. We actually have localhost as the endpoint for our testing API keys, and our OAuth provider allows plain http for localhost callbacks, so it makes testing very straightforward.

You can easily revoke the credentials if they're compromised and you don't really need your company name on the display name either.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .