Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one with access to the computer. Context 2, at work, you and anyone in the IT department have access to the computer.
When it comes to “secrets in-memory”, I have two things in mind. Storing too many secrets in memory, and the ability of user space applications to dump the memory of other processes.
- Scenario 1: GCP (and I believe AWS and Azure) stores all credentials used by the user in cleartext on disk. GCP stores keys and everything in a cleartext sqlite db. Let’s assume that the disk is encrypted at rest, but decrypted upon user login (this is what macOS FileVault would do, and I believe LUKS too)
- Scenario 2: 1Password, LastPass and other password managers decrypt and load all secrets to memory, master password included, upon application login, and they don't necessarily clean up upon application "lock". This was "revealed" a couple of years back in the Washington post; see this forum post for 1Password response. A notable exception is pass which is probably what you should use if you have the same concerns as listed in this question.
The tldr from 1Password is that protecting from attackers that have access to your system is nonsense, they could always intercept the keyboard for instance. While that’s true, I would feel very uncomfortable if all it took to steal my entire online identity was to simply dump the memory of a process. Anyone in the IT department could do that; installing a keylogger on the other hand, while possible, is much more intrusive. Dumping process memory is not straight forward with SIP enabled for macOS, but I don’t know what it would be like on Linux or Windows.
For cleartext credentials on disk, the consequence of these credentials falling into the wrong hands is very high for particular keys and access tokens. The company IT department is maybe not the greatest threat here, but this still feels like something you would want to have as part of a blind threat model (to reference GitLab’s threat model framework). For a lot of use cases, envchain and sops can solve this for you. I don’t think it’s that straight forward with cloud vendor credentials, primarily because secrets are stored in multiple databases, and every single client library that hard codes where to find the credentials would break.
So that's it. It seems clear that the modus operandi of a lot of companies is to break common sense security guidelines, keep secrets encrypted and only decrypt what you need. Could anyone provide some feedback on this train-of-thoughts and the conclusion? Is it really bad to have cleartext credentials on disk, and decrypt far more than what you need?