3

I have a script that connects to Azure Key Vault obtains credentials, and then uses those to login to Azure.

These credentials are only ever used by the scripts, and Key Vault is the only repository they're saved in.

Part of the script has a function to change the password periodically. I have been considering the period of change. It occurred to me that it would be perfectly feasible to use the credentials to perform an operation, and then immediately change the password associated with them.

Is there any benefit / issue with this that I am overlooking?

Edited to add a little context!

The theory for it is to allow for credentials to be available to multiple machines, and for key vault to provide a single source of truth. It allows an encrypted script / config file to be carried around on a usb stick, and to log in from anywhere knowing that whatever password is used it could be changed immediately after it is used.

To keep the actual password change mechanism secret it could be fun from serverless computing, and invoked with a webhook. (meaning that the password could be truly long and random)

5
  • 3
    What benefit do you expect to gain? Asssuming you choose a strong (long & truly random) password, a brute-force attempt will likely be unfeasible even when you never change your password.
    – Lukas
    Commented Sep 10, 2016 at 11:50
  • 1
    And how are you changing the password? If the script changes it then there is a possibility that someone can get hold of the script and work out the pattern? Commented Sep 10, 2016 at 12:41
  • if only one box accesses the service it's workable, otherwise, it's a lot of syncing
    – dandavis
    Commented Sep 10, 2016 at 17:46
  • 2
    This sounds a lot like using one-time passwords. But the point with them, is that the password is only sent over the network once, when it's used. If you change the pw separately each time, you're sending it twice. If someone can eavesdrop the pw you log in with, they can likely eavesdrop the new one too, when it's being changed.
    – ilkkachu
    Commented Sep 11, 2016 at 10:48
  • 1
    @ilkkachu this has been an issue I have been considering! hence the thought of having the actual changing mechanism be located in a cloud based serverless computing
    – Michael B
    Commented Sep 11, 2016 at 11:44

3 Answers 3

1

Just by pure mathematics as long as you can implement it securely and you're using strong long random passwords then yes there is benefit because the window of opportunity for a stolen password to be abused is shortened.

The big caveat is can you implement it securely or are you exposing yourself more via your password changing process.

0

I would see the point of rotating the key every time it is used. The main point of rotating the key on your script every time would be that if someone cloned your usb stick, the copy would be rendered useless on the next legit use (or, if the attacker was faster, kick you out, which would make the attack evident).

However, do note that since you are rotating the key to a vault, an attacker could steal its contents (which are presumably not rotated as much), and let you going on with your vault rotation per use.

The part that concerns me, though, are the practical issues that could arise from changing the keys. Suppose that the key rotation failed 1% of times (network timeout, usb was extracted too fast, filesystem full...). Even though it is very unlikely, with so frequent changes, you are likely to hit it soon™ and regret it. You would need to verify very carefully that the script is robust against any corner cases (you should anyway, but more so in this case, since a failed read operation is probably harmless but a failed write could lock you out).

PS: I am a bit worried about your mention of serverless computing and keeping the password change secret. You don't need to keep the password change secret, it's security shall come from the password used, not on how you changed it.

-2

Passwords basically act as a security lock for accessing the private and confidential information present in your computer or any cloud based data. There are many latest attacks and techniques to break passwords like brute force and shoulder surfing etc. To secure them, is very important, therefore they should be updated at regular intervals due to following reasons:

1. Prevention of constant access by attacker: The attacker may somehow get access to your password and logs in to your computer. Now if you change it regularly, he cannot access it again any time in future. This will prevent you from big loss and damage.

2. Prevention of key logging attacks: Key logging is a technique which is used by attacker to record keystrokes of your computer keyboard. If you change your password regularly, then it is less likely that those passwords will be of any use for the attacker.

Therefore it is always a good practice to change your passwords regularly to save your confidential data and resources.

3
  • This advice is contrary to industry advice that has been given since 2016.
    – schroeder
    Commented Nov 3, 2019 at 16:06
  • Changing passwords does nothing to "prevent keylogging".
    – schroeder
    Commented Nov 3, 2019 at 16:08
  • This leaves just your point #1, which is covered by the other answer
    – schroeder
    Commented Nov 3, 2019 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .