I have a script that connects to Azure Key Vault obtains credentials, and then uses those to login to Azure.

These credentials are only ever used by the scripts, and Key Vault is the only repository they're saved in.

Part of the script has a function to change the password periodically. I have been considering the period of change. It occurred to me that it would be perfectly feasible to use the credentials to perform an operation, and then immediately change the password associated with them.

Is there any benefit / issue with this that I am overlooking?

Edited to add a little context!

The theory for it is to allow for credentials to be available to multiple machines, and for key vault to provide a single source of truth. It allows an encrypted script / config file to be carried around on a usb stick, and to log in from anywhere knowing that whatever password is used it could be changed immediately after it is used.

To keep the actual password change mechanism secret it could be fun from serverless computing, and invoked with a webhook. (meaning that the password could be truly long and random)

  • 2
    What benefit do you expect to gain? Asssuming you choose a strong (long & truly random) password, a brute-force attempt will likely be unfeasible even when you never change your password. – Lukas Sep 10 '16 at 11:50
  • 1
    And how are you changing the password? If the script changes it then there is a possibility that someone can get hold of the script and work out the pattern? – Julian Knight Sep 10 '16 at 12:41
  • if only one box accesses the service it's workable, otherwise, it's a lot of syncing – dandavis Sep 10 '16 at 17:46
  • 2
    This sounds a lot like using one-time passwords. But the point with them, is that the password is only sent over the network once, when it's used. If you change the pw separately each time, you're sending it twice. If someone can eavesdrop the pw you log in with, they can likely eavesdrop the new one too, when it's being changed. – ilkkachu Sep 11 '16 at 10:48
  • 1
    @ilkkachu this has been an issue I have been considering! hence the thought of having the actual changing mechanism be located in a cloud based serverless computing – Michael B Sep 11 '16 at 11:44

Just by pure mathematics as long as you can implement it securely and you're using strong long random passwords then yes there is benefit because the window of opportunity for a stolen password to be abused is shortened.

The big caveat is can you implement it securely or are you exposing yourself more via your password changing process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.