ScienceThe Hacker Newsabout 2 hours ago
GitHub Verified Commits Not Cryptographically Unique
1 min read
New research demonstrates that a signed Git commit's hash is not unique. An attacker without the signing key can create a second commit with identical files, author, and date that still carries a valid signature and GitHub's "Verified" badge, despite having a different hash.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyGitHub
