Re: False negative authentication with multiple accounts on a SSH-GIT server
- From
- Harley Paterson <harley.paterson@hotmail.co.nz>
- Date
- Jan 20, 2021, 19:11 UTC
- Message-ID
- <DB8P189MB10465B7C7C89FDCD8F8C6155F9A20@DB8P189MB1046.EURP189.PROD.OUTLOOK.COM>
- In-Reply-To
- <YAg/wV05JYbzOdck@coredump.intra.peff.net>
Repost: Accedentialy forgot to CC this to the mailing list.
Show 10 quoted lines
>> Unfortunately, this leaks whether a repository exists. If Company XYZ >> has a repository for each of its clients, it then becomes easy to see if >> Company XYZ is doing work for a particular client by trying to see if a >> repository exists. > > I wonder how many hosting providers are confident that the code involved > in this isn't vulnerable to a timing attack. > > I would say "not very certain" in the case of GitHub. I don't recall any > analysis of the timing ever having happened.
I have to agree with this... It's certainly a risk, but if an attacker has enough information to guess the repository names/URLs without triggering a rate limiter, they already have a pretty good idea who Company XYZ is likely working for, and what on.
HP.