Are leaked credentials really developers' fault?
In Developers can’t seem to stop exposing credentials in publicly accessible code, the author talks about how credentials continue to be leaked in source code and alludes to developers as the cause. I don’t think that is the intent of the author, but for those who are not developers I hope to clarify so you don’t get misled. Developers are people and people are fallible, but the problem is more complicated.
Developers start writing code in one of two high-level ways. First is the blank canvas, where a developer creates an empty code repository with a blank file. The other is using an existing project to add to it or fix it. In this case a developer will clone an existing repository. The common tool that developers use for code management and storage is Git. It tracks changes in source code, much like track changes in a word document plus versioned cloud storage.
Whether you start with a blank canvas or clone a repository you will have an ignore file. This file, .gitignore, tells Git which files to ignore. To help developers get started many Git services like GitHub and Bitbucket provide ignore-file templates based on the programming language you use. However, those tools only allow you to select one programming language for your ignore file, so if you are using more than one language you will have to add to it accordingly. While this is useful for ignoring superfluous files, because most programming languages do not have a standard for credential files it still falls on the developer to determine where to store credentials and how to ignore them.
So now we see the main problem developers face: they have to be careful not to accidentally include or save files with credentials, and there are no standards in most languages. However, the question we should be asking is why developers do not have standards or still have to store credentials at all. In my view the reason goes back to the fact we in the security space have not innovated in IAM, specifically authentication. We started with username and password and honestly have not moved much further past that. Due to that we still leave the burden of managing usernames and passwords to the user, and developers are users too.
I hope we in the security space can truly help to innovate on authentication the same way we have done with firewalls and antivirus. Passkey technology is a step in the right direction, though I do not know if it will be enough or if it will help developers manage server-to-server authentication, which is the problem I have been speaking about.