如何在GitHub上托管的Python脚本中保持开发人员密钥的秘密

Question

I am developing an open source Python-powered Twitter client, and to access the Twitter API and login using OAuth, I have registered my client with Twitter and they have given me a unique consumer key and consumer token (henceforth to be referred to as "developer key"). These are unique to my client, and all copies of my client have to use the same developer key. Now, I have to use the developer key in a Python script (main.py) and since it is a script, there is no binary. Also, I have to upload my code to GitHub since I am using git on GitHub for content tracking. How do I keep my developer key secret? Please keep in mind that I plan to distribute the same client to users.

A keyring seems the best option, but I want a way that only the application can access the keyring, not even its users (outside the application). And nobody should be able to figure out how to access the keyring by looking at my code.

Note: "To use the Twitter API, the first thing you have to do is register a client application. Each client application you register will be provisioned a consumer key and secret. This key and secret scheme is similar to the public and private keys used in protocols such as ssh for those who are familiar. This key and secret will be used, in conjunction with an OAuth library in your programming language of choice, to sign every request you make to the API. It is through this signing process that we trust that the traffic that identifies itself is you is in fact you." - http://dev.twitter.com/pages/auth

Answer 1

You can use OAuth.io for this purpose.

The concept is simple:

• you just have to put your API Keys in the key manager of OAuth.io
• in your source code, use the OAuth.io's public key

Your secret key won't be leaked in this way.

Check this blogpost using Twitter API with OAuth.io: http://blog.oauth.io/api-call-using-twitter-api/

The complete sample code (in javascript) is on JSFiddle: http://jsfiddle.net/thyb/kZExJ/5

$('button').click(function() {
    OAuth.initialize('oEcDIQahkO4TUAND-yTs-H6oY_M') //OAuth.io public key
    OAuth.popup('twitter', function(err, res) {
        // res contains tokens (res.oauth_token and res.oauth_token_secret)
        res.get('/1.1/statuses/home_timeline.json').done(function(data) {
            // do what you want with data
        })
    })
})

Answer 2

The key must be outside the source code, and be passed to the program through the command line or a configuration file. There's no way to hide the key if you embed it in the source code (a debugger, fi, will show it).

More importantly, to avoid collisions or users getting to know the key, one should not have different users share the same key . What's typically done is to set up a web service that knows the key and talks to the final server (Twitter). The client software would communicate with the service using a per-user key.

Answer 3

Extending on Apalala's answer, I believe what is meant is a 'proxy' web service. People send you their requests and you sign it on their behalf and send it to twitter, once they allow your application access of course.

You don't have to worry about people spamming you because they will have to log in to twitter anyway to use it.

Only problem, like anywhere else, is how do I trust your application enough to allow it in the first place :)

Answer 4

I would not distribute any key with the code; if people want to use it, they will just have to apply for their own key. Any other approach can be abused.

Answer 5

Create a configuration file where you will keep the key. Do not post the original configuration file into git-hub.

You can use Python Config Module (overkill) or YAML (my choice) or plain Files.

If you want people just to get up and running you can create a prompt which runs only the first time in a system and generate the configuration file by taking user input.