1

The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, thus the original problem is not fully solved because if that "master" key/creds are transmitted insecurely, stored in source-code, or otherwise compromised, then it compromises the secrets after all.

Can someone who is slightly more educated on the subject matter comment on how secrets managers tackle the authentication problem or otherwise make it more secure over traditional API-key authentication?

Some example systems: Thycotic Secret Server, Amazon Secrets Manager, Hashicorp Vault.

  • There's many systems that store credentials. You're probably best off picking a few and asking about those, otherwise this question is WAY too broad IMO. – Daisetsu Oct 10 '18 at 5:13
  • @Daisetsu updated with names of some systems. – the_endian Oct 10 '18 at 14:53
0

It always depends how critical is your software.

Software
Yes, most of the times you still have to provide a key or credentials at some point, programmatically, or by giving access to a file only to a specific service and that file contains the secret. If you're choosing any of these ways, it is important to erase the value from the memory as soon as possible (immediately after the authentication if this is your purpose).

If your purpose is encryption or digital signing, you can always use public key cryptography, give the software the public key (and use that one for encryption/ digital signing) and use somehow else (offline/ stored separately) the private key.

Hardware
If you can afford hardware, then a solution might be storing the master secret on a separate device that you are sure enough it won't be compromised, and couple that device to a server in a secure cage/ data-center.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.