I have a deployment system with a user interface that is accessible over the Internet. I want to make it more secure by re rolling the password periodically over the API. Is there a safe way I can store the password locally on my computer? I’m worried about someone brute forcing the password on the publicly available interface.

  • Using the change password form? – Ángel Feb 20 '18 at 22:04
  • I’m going to do it directly over the REST API. – dkimot Feb 20 '18 at 22:04
  • Ok, using the change password REST API. But, could you clarify where's the problem? – Ángel Feb 20 '18 at 22:17
  • I want to access the password. I want to automate the whole process so I need to store the password for later use. I can’t hash it because I need to use it for an environment variable in a service. – dkimot Feb 20 '18 at 22:19
  • Is your computer presumed secure? It will depend on your threat model. If you are only worried about the publicly available interface, storage in local computer should be no issue. – Ángel Feb 20 '18 at 22:21

If you're the system's developer, that's an insecure model. The password should be salted and hashed at client side, then hashed again with a server-supplied nonce, and that hash checked on the server. The client machine should also be checked before checking the password. If the IP isn't static, it can be done with certificates.

The user-entered password shouldn't be used as anything other than a password, not as a key (use a KDF), not as an environment variable, nor stored any longer than it takes to hash it. Other secrets should be irreversibly derived from it and other values.

If you're not the developer and have been forced into this model by an application, then it seems like you're just looking for a local storage password manager like LastPass.

  • The deployment system is open source so I'll have to dig into the auth system and make some modifications so I can get a one-time use token verified by a certificate. Will that improve the security of the system? – dkimot Feb 21 '18 at 6:33
  • Depends on the implementation, but if done right it's more secure. And keeps plaintext passwords from being sent and stored. What is the password normally stored in an environment variable for, BTW? – ZOMVID-20 Feb 21 '18 at 6:44
  • The deployment system manages Docker containers, one of which needs to make changes to the other Docker containers. Are there any big gotchas I need to be aware of? Any articles you would suggest? Thanks for your help. – dkimot Feb 21 '18 at 6:46

Well - you are asking for trouble here with your current setup. Why do you have a deployment interface exposed to the web?

You need to add

  1. IP whitelisting or host internally and connect into the network securely
  2. 2FA using an authenticator - SMS is out these days
  3. Store the salted hash not the password
  4. Use PBKDF2 or bCrypt for the hashing. Look up current suggested iterations numbers and imimplementation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.