In my private repo, i see commits by another USER!!

[adamd1985]

Select Topic Area

Bug

Body

This guy: https://github.com/yyeboah

What does this mean?

[Dineth-H]

Here are a few possible reasons for this:

• You may have invited the user as a collaborator on the repository.
• The user may have a fork of your repository and pushed their changes back to the remote repository.
• The user may have access to your repository credentials.
• If you're not sure why the user is able to commit to your repository, you can check the repository's collaborators list and fork list. If you don't want the user to be able to commit to your repository, you can remove them as a collaborator or delete their fork.

Here are some other things you can do to secure your private GitHub repository:

• Use a strong password manager and enable two-factor authentication (2FA) on your GitHub account.
• Be careful about who you invite as collaborators to your repositories.
• Regularly review the repository's collaborators list and fork list.
• If you suspect that your account has been compromised, change your password immediately and contact GitHub Support.

I hope this information is helpful.

[adamd1985]

Hey @ghostinhershell - it didn't, I changed passwords, I regenerated keys and added these to GH again.

Still the same, my commits show as the user: yyeboah. Is this a GH bug?

[luismeruje]

@adamd1985 I am seeing the same thing happen in a private repository.

It seems that if you configure your email wrong, and set it as the email of someone else, as @Dineth-H mentioned (e.g., someone with an email very similar to yours) the commit will show up as having been done by the user that is associated with that email.

@Dineth-H This seems like it could be a severe security issue since it basically allows spoofing by making it seem like someone else has done a commit.

[ghostinhershell]

Hey @adamd1985 and @luismeruje,

We do have a support doc that covers this scenario: Why are my commits linked to the wrong user?. In short:

GitHub uses the email address in the commit header to link the commit to a GitHub user. If your commits are being linked to another user, or not linked to a user at all, you may need to change your local Git configuration settings, add an email address to your account email settings, or do both.

Now, if after taking a look at the article and following the suggestions there, you guys still suspect this to be a security issue, opening a ticket on our Support page would be the only next step.

[luismeruje]

@adamd1985 @spenserblack @ghostinhershell @Dineth-H

After taking a look at GitHubSecurity's page, this is a known issue that github has chosen to accept. From GitHubSecurity's page that details ineligible bug bounty submissions here under "Impersonating a user through git email address":

Impersonating a user through git email address

    Because Git is a distributed version control system, GitHub must use the commit email address to assign attribution. 
When you push a repository to GitHub.com it may contain one or more commits, some of which you may not have 
authored. For example, imagine a scenario where you collaborated with a number of people on a git repository before 
you made your first push of that repository to GitHub.com. This push would contain a number of commits from several 
authors. It would be incorrect to assign all of the commits to the person doing the push, so we use the commit log email 
addresses to assign attribution on GitHub.com. Each subsequent push to GitHub uses this same logic to assign attribution
 of commit authors.

    It’s important to note that impersonating another GitHub user in this fashion doesn’t grant you access to any of their 
repositories or give you any privileges you didn’t already have. However, GitHub does consider impersonation an account 
abuse issue that we take very seriously. If someone is wrongfully impersonating you, please let us know and we will 
investigate the matter and deal with it as quickly as we can. In addition, if you are still concerned about this, you and 
your team can choose to use Git’s built in options to sign commits with a GPG key (check out the git commit -S command).

Basically github expects you to find out by yourself that you are being impersonated and contact them. While they do offer the option to sign your commits with a GPG key, I would wager that 80-90% of commits are not signed. I myself haven't signed any commits until now because I was not aware impersonation was possible. I am not sure that github's way of handling this is sufficient. Perhaps disabling non-signed commits and requiring users to explicitly accepts the risks of non-signed commits would be better?
But of course, that is just my opinion.

And I have a question @ghostinhershell. The example given states that one of the reasons why emails are used is to allow different authors in a single push. How would that push work if a part of the commits were signed and the other part was not? Would they still be correctly signed and show up as such?

[peasantman1]

Hey @adamd1985 and @luismeruje,

We do have a support doc that covers this scenario: Why are my commits linked to the wrong user?. In short:

GitHub uses the email address in the commit header to link the commit to a GitHub user. If your commits are being linked to another user, or not linked to a user at all, you may need to change your local Git configuration settings, add an email address to your account email settings, or do both.

Now, if after taking a look at the article and following the suggestions there, you guys still suspect this to be a security issue, opening a ticket on our Support page would be the only next step.

bc they are trying to frame me so to look like a developer so i guess they need a smart person to fit there nartitive of me being interesd in codeing wow this is a joke these hackers work for goverment and 6 yrs of them commiting cyber slavory they need a way out to plant this bs on me and u

[spenserblack]

Random guess: If you make commits on the web by changing a file on github.com, the commit has the correct author, and if you make a commit locally and push it it has the wrong author. Is that right?

Last I checked, GitHub identifies commit authors by their email addresses. Run git config user.email locally to check if your email is spelled correctly. You can use git config --global user.email to check the global setting, or run git config user.email (no --global) in a repository just in case the repository's settings are different from global settings.

[adamd1985]

Hey @spenserblack - yes, or randomly - I just cannot understand :(

Though I use the anonymous email option offered by GH. It is so annoying, this rando - appears as collaborator in all my projects because some of the commits done by me show as him.

[adamd1985]

Update @spenserblack - you had a good lead. This user guessed my anonymous email. I regenerated the anonymous GH email, and now I can commit without having the code attributed to them.

@Dineth-H , @ghostinhershell, and @luismeruje - this is solved. Thanks!

Github might need to look at email spoofing.

[NeedagoblinX]

Try removing the malware from your own code and you may reclaim your beautiful masterpiece as yours once again.

[Danni1326]

Their basically using your address to push call through, collect the money and wear your account out.

[zamryOn]

@luismeruje

[zamryOn]

[zamryOn]