Questions tagged [secrets-management]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
65 views

What are the advantages of password "leasing"

One the Hashicorp Vault basic feature is secret leasing. They state: Leasing and Renewal: All secrets in Vault have a lease associated with them. At the end of the lease, Vault will automatically ...
1
vote
1answer
93 views

What is a pre-warmed secret?

As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2 Note on pre-warmed secrets: An attacker can circumvent the countermeasures described ...
1
vote
2answers
72 views

How to do auth without user interaction in an enterprise environment?

We are building a Chrome Extension that will be force-installed on each employee's browser for the companies we work with. We currently use OAuth but many employees are forgetting to sign up. We are ...
2
votes
3answers
103 views

How can I pass secrets to a compromised container without the attacker being able to see them?

The most common method of passing secrets to a docker container is through ENVs. The problem is: Imagine that your docker container is hosting a HTTP server that can have a security exploit (like any ...
0
votes
0answers
81 views

What's the best practices for storing 2fa tokens? [duplicate]

What are the best practices for securely storing TOTP secrets as an extra layer of security for user accounts? This would be used in a webapp login and stored in a server database so that the user can ...
1
vote
1answer
198 views

How bad is it to store credentials in clear text on disk and in memory?

Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one ...
2
votes
2answers
196 views

How to securely share a secret/ password by between n individuals, so that majority consensus is required to retrieve the password / secret?

The following constraints apply cannot use physical storage medium (such as Safe/ Vault) the service used to store secret/ password should be highly available and accessible from anywhere in the ...
1
vote
2answers
265 views

Environment variables vs secrets managers

I am testing an in-development app locally. Currently I use environment variables to store JWT secrets and database usernames and passwords. I am interested in further securing this, and found out ...
0
votes
1answer
686 views

It's secure to store private keys in AWS Secret Manager?

I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
0
votes
0answers
45 views

Secure memory buffer

We are designing a Python application and we need to "load" encryption secret key in "memory" at the application boot. It can be also an admin pin code. Anyway, just some data. Our ...
2
votes
1answer
325 views

Is Python's `secrets` module using the same code as the `random` module?

The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually ...
18
votes
4answers
5k views

Microsoft Word to secure stored data

I understand the purpose of Microsoft Word is not to store secret information. However, I would rather spread my secret information between a Password Manager and a Word document, each of which has ...
1
vote
2answers
817 views

is this a good practice for storing private keys?

I'm working on a centralized exchange for cryptocurrencies. the approach that I'm taking for some reasons is to create an account(private key) per user inside platform. so these accounts should be ...
-1
votes
1answer
121 views

How to secure the key in an offline package

I have a package to be shared to Bob which contains: an encrypted data.zip Application, which will have logic to decrypt the data Bob will run Application and it will decrypt the data.zip. Now for ...
-2
votes
1answer
861 views

Source of RegEx examples of Secret Detection patterns in repositories?

Where can I find RegEx that can pattern match common secret strings? I have a product that scans repos and commits and in case a developer tries to commit a secret (i.e. passwords, keys). It scans for ...
98
votes
12answers
15k views

How do very big companies manage their most important passwords / keys?

Third-party password managers such as 1password, etc. are useful for people, businesses, etc. to store passwords. But I bet Facebook, Google, Twitter and other super big tech companies don't use such ...
1
vote
2answers
111 views

Can a symmetric key be safely embedded anywhere in a .NET desktop client program

Is there a native way, that is, one not requiring the purchase of an expensive third-party obfuscator, that a .NET desktop client program, deployed to the users' Windows desktops from a LAN server ...
0
votes
0answers
96 views

Encrypt files transparently from applications

Many CLI applications store or need secrets in plaintext files. I'm searching preferably for a tool, or a methodology, to encrypt those files without the application knowing. What do I mean by that : ...
0
votes
1answer
196 views

Is it possible to store a user's third-party private API key securely?

Let's say there is a website called Service. Service has a read-only API. A user of Service has an API key that they can change at any time if they think their API key has been compromised. If I want ...
0
votes
2answers
104 views

Secret sharing scheme for disaster recovery with asymmetric key?

I want to backup many secrets using a secret sharing scheme, to make sure my family can access those secrets in case of my death. I need a way to keep adding secrets (without distributing new shares). ...
1
vote
1answer
267 views

Where to store pydrive secret?

Backstory: been toying with the idea of setting up some raspberry pi cctv cameras. originally I was going to store all footage for 31 days (complying with DPA) on a network drive but decided against ...
2
votes
2answers
752 views

Alternatives to hardcoding or encrypting key material in source code

What is best practice as of 2019 for storing secrets inside applications? Sometimes in an app, you might need to access some web-resource or other asset that requires authentication or decryption. ...
2
votes
0answers
124 views

Securing key generation by 3rd parties

I'm working on an IoT product that uses the cloud once finished. Each of these devices has a serial number, from which a key is derived. This key is then stored on the device itself and in the cloud. ...
1
vote
1answer
556 views

Getting data from AWS Secrets Manager at deployment (ENV variables) vs. at run-time (e.g. aws-sdk)

Given a serverless deployment of some kind (i.e. something that relies on AWS Lambda for computing), and secrets stored in AWS Secrets Manager, what difference from security standpoint is there ...
0
votes
0answers
64 views

How secure is this scheme?

Introduction of the cryptosystem Let's say we have a system with a central server SRV that is considered secure (communication with this server is secured too with TLS). Then let's say we have many ...
0
votes
1answer
426 views

Handling secrets and environmental variables in Docker-k8s-skaffold dev environment

Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it. Just ...
1
vote
1answer
105 views

Securing Code Secrets - What is the relevance if the host gets compromised?

I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
5
votes
1answer
3k views

Where to store secrets in .NET applications?

I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
4
votes
2answers
2k views

IN OAuth 2.0, how is the client secret supposed to be kept secret?

Using most OAuth 2.0 flows, a client application can identify itself to the authorization server by means of a "client id" and "client secret." The OAuth 2 specification says that the client secret ...
2
votes
1answer
118 views

Is getpass.io secret-based artwork a threat?

When typing a secret keyword into Getpass, a little jdenticon is showing on the right, based on the secret that was entered. The FAQ on Getpass states the following about it : Did you notice that ...
2
votes
0answers
138 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
1
vote
2answers
850 views

How do you use initialization vector? [duplicate]

My application needs to store some sensitive information. I want to encrypt the data before I store it. At some point in the future, I want to be able to read and decrypt all the data. For a ...
0
votes
0answers
56 views

How should I store and distribute deployment configurations?

When developing web applications that require access to a database, or any other service, they will somehow have to possess a secret like a password or connection string. This secret has to be ...
0
votes
1answer
550 views

How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?

Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following: seal "azurekeyvault" { tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" client_id = "...
0
votes
1answer
658 views

If one HashiCorp Vault Policy allows a capability, and another denies it, how does it decide which Policy to honor?

HashiCorp Vault is an open source tool for secrets management. I'm using it for this purpose, and have come across a minor issue. I seemingly cannot deny access to a specific API path. I've tested ...
22
votes
3answers
9k views

Is an AWS "Access Key ID" a secret?

AWS's "Secret Key" is (obviously) a secret, but should an "Access Key" alone (without the corresponding secret key) be considered a secret too?
3
votes
1answer
2k views

Can I use HashiCorp Vault to restrict access to credentials based on CIDR ranges?

This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet: A python script gets populated by configuration management ...
6
votes
2answers
1k views

Vault Secret server best practices

Recently Hashicorp released a secrets management solution called Vault. It is a free and open source general secrets storage and secret generator, acting as a Vault for passwords, encryption keys, ...