Timeline for how to protect a string (secret key) in my env file in node.js project?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 25 at 17:25 | comment | added | browsermator | I shouldn't say it's not possible, because you could require a user to input the key each time a decryption is needed. (so if you never store it, you don't have to protect it...) | |
| Sep 25 at 17:19 | comment | added | browsermator | "I want to protect these keys from anyone, even host administrator." That's not possible. You can tie the encryption key to the hardware, but in order for your code to decrypt, it needs access to the key. (or to TPM) An admin could also run your code. The best you can do is secure it against an attacker who has stolen the encrypted value, but cannot execute code on the machine. | |
| Sep 23 at 11:40 | comment | added | MisterMiyagi |
Note that at least on Linux, the administrator root can inspect the entire environment of any process. Don’t put secrets into the environment if you don’t trust root.
|
|
| Sep 23 at 10:04 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Aug 24 at 9:05 | answer | added | localhostport80 | timeline score: 0 | |
| Aug 21 at 8:11 | comment | added | aref razavi | how can I implement whitebox cryptography in node js application? @margaret-bloom | |
| Aug 19 at 14:07 | comment | added | Margaret Bloom | if your administrator have full control over the machine, your only option is to move those secrets to another machine that will proxy the request to the original web service (the evil admin can still call the service at will). Another, cumbersome, way to reduce the surface of attack is to have your app read the secrets from stdin at startup, use them to get an access token and wipe them from memory. anything else is whitebox cryptography. | |
| S Aug 19 at 7:19 | review | First questions | |||
| Aug 19 at 14:19 | |||||
| S Aug 19 at 7:19 | history | asked | aref razavi | CC BY-SA 4.0 |