Questions tagged [secrets-management]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
58 views

Where to store pydrive secret?

Backstory: been toying with the idea of setting up some raspberry pi cctv cameras. originally I was going to store all footage for 31 days (complying with DPA) on a network drive but decided against ...
0
votes
0answers
53 views

When Deserializing a User in Passport is there any reason not to remove Secrets?

I am using the passport-local passport strategy. I want to follow the principle of least privilege, so I was wondering if I should remove certain secret properties from the user when I deserialize ...
0
votes
0answers
58 views

Over engineered?

I'm looking at secrets management for machines, and I'm implementing my designs with Hashicorp Vault. I'm concerned that I'm over-engineering the solution and need some guidance please. In my current ...
1
vote
2answers
140 views

Alternatives to hardcoding or encrypting key material in source code

What is best practice as of 2019 for storing secrets inside applications? Sometimes in an app, you might need to access some web-resource or other asset that requires authentication or decryption. ...
2
votes
0answers
112 views

Securing key generation by 3rd parties

I'm working on an IoT product that uses the cloud once finished. Each of these devices has a serial number, from which a key is derived. This key is then stored on the device itself and in the cloud. ...
1
vote
1answer
57 views

Getting data from AWS Secrets Manager at deployment (ENV variables) vs. at run-time (e.g. aws-sdk)

Given a serverless deployment of some kind (i.e. something that relies on AWS Lambda for computing), and secrets stored in AWS Secrets Manager, what difference from security standpoint is there ...
0
votes
0answers
49 views

How secure is this scheme?

Introduction of the cryptosystem Let's say we have a system with a central server SRV that is considered secure (communication with this server is secured too with TLS). Then let's say we have many ...
0
votes
1answer
79 views

Handling secrets and environmental variables in Docker-k8s-skaffold dev environment

Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it. Just ...
0
votes
0answers
34 views

Securing user secrets in KeyChain vs Keychain+Biometrics

The common approach to secure user secrets in native applications seems to be storing the secret in keychain and adding an additional layer of protection by way of biometrics/touchId/FaceID. My ...
1
vote
1answer
68 views

Securing Code Secrets - What is the relevance if the host gets compromised?

I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
0
votes
1answer
268 views

Where to store secrets in .NET applications?

I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
1
vote
1answer
221 views

IN OAuth 2.0, how is the client secret supposed to be kept secret?

Using most OAuth 2.0 flows, a client application can identify itself to the authorization server by means of a "client id" and "client secret." The OAuth 2 specification says that the client secret ...
2
votes
1answer
101 views

Is getpass.io secret-based artwork a threat?

When typing a secret keyword into Getpass, a little jdenticon is showing on the right, based on the secret that was entered. The FAQ on Getpass states the following about it : Did you notice that ...
2
votes
0answers
81 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
1
vote
2answers
182 views

How do you use initialization vector? [duplicate]

My application needs to store some sensitive information. I want to encrypt the data before I store it. At some point in the future, I want to be able to read and decrypt all the data. For a ...
0
votes
0answers
44 views

How to share administrator access in a Safe and special way?

I have assigned to a project that our customers needs to know their devices administrator password. We used the envelope technique with a special sticker on it, but this not the best way because the ...
0
votes
0answers
44 views

Is Azure Key Vault more secure than the machine certificate store?

I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
0
votes
0answers
37 views

How should I store and distribute deployment configurations?

When developing web applications that require access to a database, or any other service, they will somehow have to possess a secret like a password or connection string. This secret has to be ...
0
votes
1answer
218 views

How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?

Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following: seal "azurekeyvault" { tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" client_id = "...
0
votes
1answer
343 views

If one HashiCorp Vault Policy allows a capability, and another denies it, how does it decide which Policy to honor?

HashiCorp Vault is an open source tool for secrets management. I'm using it for this purpose, and have come across a minor issue. I seemingly cannot deny access to a specific API path. I've tested ...
15
votes
3answers
3k views

Is an AWS “Access Key ID” a secret?

AWS's "Secret Key" is (obviously) a secret, but should an "Access Key" alone (without the corresponding secret key) be considered a secret too?
2
votes
1answer
678 views

Can I use HashiCorp Vault to restrict access to credentials based on CIDR ranges?

This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet: A python script gets populated by configuration management ...
6
votes
2answers
1k views

Vault Secret server best practices

Recently Hashicorp released a secrets management solution called Vault. It is a free and open source general secrets storage and secret generator, acting as a Vault for passwords, encryption keys, ...