Why are environment variables safe after 2022 Heroku breach?

Question

In their communication about the april 2022 breach (summary here), Heroku states that environment variables (other than Review apps and CI variables) were safe because they are encrypted at rest.

We also wanted to address a question regarding impact to environment variables. While we confirmed that the threat actor had access to encrypted Heroku customer secrets stored in config var, the secrets are encrypted at rest and the threat actor did not access the encryption key necessary to decrypt config var secrets.

I wonder what prevents the hacker who could download them, to try many random decryption keys for the DATABASE_URL environment variable for example, until it decrypts to something that starts with postgres, and then they would have found the key. Once they have the key, they can decrypt everything else.

What am I missing here?

Answer 1

What you are suggesting is attempting to brute force the decryption. If this were possible then public key cryptography would not exist, and that means no such thing as Ethereum.

Environment variables are never safe, because they actually expose themselves to every interface that interacts with the deployment of your service. Sure encryption at rest is a good idea, but almost every single service out there is using some provider that does that by default. It's a bit like saying, your money is safe because you put it in a bank.

There are tons of reasons to never using environment variables for storing credentials. The primary reasons are that it actually adds points of exposure for your credentials, and doesn't reduce them.

Amazingly this is exactly the wrong thing that Heroku suggests:

Store your secrets in environment variables. A library like dotenv can seamlessly load and make use of these variables, provided they're accessible in a secure location. Another option is to use a product like Hashicorp Vault, which allows your application to manage secrets through a configurable CLI.

I honestly can't believe there is a provider out there that people are using that has such advice. And since there are just only a handful of strategies, which environment variables being the worst, I feel obligated to share a link to this talk on the adult solutions to the problem.