How to use password certificate in code securely

Question

I have a piece of code that is using a certificate for authentication with a cloud service. The certificate is stored locally, and is protected by a password - thus what the developers did is to hardcode the password in their code.

I was wondering if there is a more secure method of performing this, as if the piece of code is compromised, the certificate password is compromised as well.

Any better solutions?

Answer 1

You should ask your developers if they are completely mad. There are a number of serious issues, that show the lack of competence of your developers.

1. Hard code variable data. So, if anything changes, for example you change the password, the developers need to be called in to change the software (including the tests, install etc.) In the past that was great for job security.
2. Encode sensitive security data, in this case the password. Like you already guessed, if someone sees the source code, your security is lost. The fact that they have done this means that they have no clue or regard for security.
3. Your certificate has a limited life-span. That means that your new certificate must have the same password or else your developers need to recompile, test and distribute the software.

So what should you do?

1. Change the password. Consider it compromised, because all the developers know it by now.
2. Examine whether the password on the certificate adds anything to your security; determine what risks are mitigated by the password. If you properly manage the private keys, it might not be necessary to use a password. On the other hand, if you need a password, that should be entered when the program starts.
3. Examine how, for example, ssh stores its secrets. On UNIX/Linux systems, that would be in a directory with 700 / rwx------ and all the files will have 600 / rw-------, so only 1 specific user has access to them.