[trees101]

why would you do that rather than just revoking the key directly in the anthropic console?

[mingus88]

It’s the key used by the attackers in the payload I think. So you publish it and a scanner will revoke it

[trees101]

oh I see, you're force-revoking someone else's key

[rswail]

Which is an interesting DOS attack if you can find someone's key.

[OJFord]

The interesting thing is that (if you're an attacker) your choice of attack is DoS when you have... anything available to you.

[freakynit]

Does this mean a program can be written to generate all possible api keys and upload to github thereby revoke everyone's access?

[kylecazar]

They are designed to be long enough that it's entirely impractical to do this. All possible is a massive number.

[freakynit]

That's true tho... possible, but impractical.

[antonvs]

Not possible given the amount of matter in the solar system and the amount of time before the Sun dies.

[cortesoft]

Only possible if you are unconstrained by time and storage.

[eru]

Not only you, but GitHub too, since you need to upload.

Storage is actually not much of a problem (on your end): you can just generate them on the fly.