Questions tagged [secrets-management]
The secrets-management tag has no usage guidance.
53
questions
0
votes
0
answers
37
views
In a web application, what would you consider the best way to store secret keys obtained via an SDK?
Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user.
Currently when ...
- 1
1
vote
1
answer
53
views
Keeping customer secrets safe from sysadmins and devs in Kubernetes
I've spent a few weeks on GCP and GKE (Kubernetes) trying to figure out how to store customer secrets. The secrets are used by some application even when the user is not logged on so I want to ensure ...
0
votes
0
answers
24
views
Which is more secure: Certificate or Secret inside our Azure Active Directory App, and why? [duplicate]
Inside our Azure Active Directory, we have 2 options to secure our calls to the Active Directory App:
Secret
Certificate
Which option is more secure and why? Inside our applications which will be ...
0
votes
2
answers
66
views
Whats the difference between secret and password managers?
Are there fundamental underlying differences in how secrets and passwords should be managed?
I'm curious of the technical/cryptographic differences between secret managers and password managers are. ...
1
vote
1
answer
58
views
Using AWS System Manager Parameter Store SecureString in config file in ec2
On an ec2 box I am running a service that reads vars from a config file. One var's value is stored in AWS System Manager as a SecureString. I want to use that value in the text file securely.
I can ...
- 11
1
vote
1
answer
44
views
How can I share web-platform credentials across multiple desktop apps on Windows?
I have two desktop apps, each authenticate against our server using OIDC in order to call our web api. Currently the users need to login independently in each application.
I noticed when using ...
- 113
0
votes
1
answer
47
views
Secret security in containerised environment
I've been having a discussion with a developer about storing sensitive information in environment variables. Specifically within a containerised environment such as Azures Container apps.
Background ...
- 123
1
vote
0
answers
71
views
How to secure Kubernetes secrets on bare metal?
(This question is based on a comment I made on How Vault agent solves Secret Zero challenge in Kubernetes?)
We are planning to run some of our software in a Kubernetes cluster running on bare metal (i....
- 111
2
votes
0
answers
74
views
Securely store application secrets in production without 3rd party KMS
Integrated Security
I have a ASP.NET web application with connection strings and other secrets to protect in production. Ideally I would like to use IntegratedSecurity to keep SQL credentials out of ...
- 21
1
vote
1
answer
36
views
Securely loading private tokens on a local machine
When doing local development, I have to export a token needed for downloading dependencies from a private repository. For example:
export NPM_TOKEN=token_value
I want to make sure that this token is ...
- 11
1
vote
1
answer
93
views
API Client Secrets are Being Logged in Plaintext (PowerShell Logs)
I'm currently implementing a PowerShell script to call the Sophos API (https://developer.sophos.com/intro).
Write-Output "`nEnter the Sophos API key / client secret."
$ClientSecret = Read-...
4
votes
0
answers
54
views
Best practice for storing security tokens in source code [duplicate]
I have a PHP system and I need to store some tokens for operations like:
Database username and password
API token
Keys for encryption
It turns out that for a long time only I manage the source code, ...
- 163
1
vote
2
answers
65
views
Best and safest way to store secret key used for PKA on server?
I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example:
Create a 0500 access directory on my server
...
- 115
0
votes
0
answers
215
views
Best Practice for retrieving secrets securely
So a company I work with currently is using a password management system that lets us retrieve the passwords for an application by providing a secure key to an API. Currently, the key is stored in ...
- 111
0
votes
1
answer
226
views
Encrypting/Decrypting User Secrets with Password
I am designing an account system that will use salting/hashing to securely store and compare passwords. For now, I'm looking at using bcrypt for password hashing. Somewhere along the way I'll need a ...
- 103
2
votes
0
answers
149
views
How Vault agent solves Secret Zero challenge in Kubernetes?
HashiCorp Vault Agent creates a sidecar that talks to Vault server and injects secrets as files into containers. The agent presumably uses Kubernetes Service Account in some way. But ultimately there ...
- 173
0
votes
0
answers
125
views
What are the advantages of password "leasing"
One the Hashicorp Vault basic feature is secret leasing. They state:
Leasing and Renewal: All secrets in Vault have a lease associated with them. At the end of the lease, Vault will automatically ...
- 101
1
vote
1
answer
124
views
What is a pre-warmed secret?
As described here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-13.html#proposed-countermeasures-2
Note on pre-warmed secrets: An attacker can circumvent the
countermeasures described ...
- 23
2
votes
2
answers
269
views
How to do auth without user interaction in an enterprise environment?
We are building a Chrome Extension that will be force-installed on each employee's browser for the companies we work with.
We currently use OAuth but many employees are forgetting to sign up.
We are ...
- 121
2
votes
3
answers
183
views
How can I pass secrets to a compromised container without the attacker being able to see them?
The most common method of passing secrets to a docker container is through ENVs.
The problem is:
Imagine that your docker container is hosting a HTTP server that can have a security exploit (like any ...
- 121
3
votes
1
answer
576
views
How bad is it to store credentials in clear text on disk and in memory?
Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one ...
- 183
3
votes
2
answers
547
views
How to securely share a secret/ password by between n individuals, so that majority consensus is required to retrieve the password / secret?
The following constraints apply
cannot use physical storage medium (such as Safe/ Vault)
the service used to store secret/ password should be highly available and accessible from anywhere in the ...
- 177
2
votes
2
answers
1k
views
Environment variables vs secrets managers
I am testing an in-development app locally.
Currently I use environment variables to store JWT secrets and database usernames and passwords.
I am interested in further securing this, and found out ...
- 207
0
votes
1
answer
2k
views
It's secure to store private keys in AWS Secret Manager?
I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public ...
0
votes
0
answers
85
views
Secure memory buffer
We are designing a Python application and we need to "load" encryption secret key in "memory" at the application boot.
It can be also an admin pin code. Anyway, just some data.
Our ...
- 101
2
votes
1
answer
870
views
Is Python's `secrets` module using the same code as the `random` module?
The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually ...
- 21
18
votes
4
answers
6k
views
Microsoft Word to secure stored data
I understand the purpose of Microsoft Word is not to store secret information.
However, I would rather spread my secret information between a Password Manager and a Word document, each of which has ...
- 819
1
vote
2
answers
1k
views
is this a good practice for storing private keys?
I'm working on a centralized exchange for cryptocurrencies. the approach that I'm taking for some reasons is to create an account(private key) per user inside platform. so these accounts should be ...
- 13
-1
votes
1
answer
214
views
How to secure the key in an offline package
I have a package to be shared to Bob which contains:
an encrypted data.zip
Application, which will have logic to decrypt the data
Bob will run Application and it will decrypt the data.zip.
Now for ...
- 99
-1
votes
1
answer
2k
views
Source of RegEx examples of Secret Detection patterns in repositories?
Where can I find RegEx that can pattern match common secret strings?
I have a product that scans repos and commits and in case a developer tries to commit a secret (i.e. passwords, keys). It scans for ...
- 11
100
votes
12
answers
17k
views
How do very big companies manage their most important passwords / keys?
Third-party password managers such as 1password, etc. are useful for people, businesses, etc. to store passwords. But I bet Facebook, Google, Twitter and other super big tech companies don't use such ...
- 951
1
vote
2
answers
164
views
Can a symmetric key be safely embedded anywhere in a .NET desktop client program
Is there a native way, that is, one not requiring the purchase of an expensive third-party obfuscator, that a .NET desktop client program, deployed to the users' Windows desktops from a LAN server ...
- 121
0
votes
0
answers
162
views
Encrypt files transparently from applications
Many CLI applications store or need secrets in plaintext files.
I'm searching preferably for a tool, or a methodology, to encrypt those files without the application knowing.
What do I mean by that :
...
- 101
0
votes
1
answer
365
views
Is it possible to store a user's third-party private API key securely?
Let's say there is a website called Service. Service has a read-only API. A user of Service has an API key that they can change at any time if they think their API key has been compromised. If I want ...
- 101
0
votes
2
answers
157
views
Secret sharing scheme for disaster recovery with asymmetric key?
I want to backup many secrets using a secret sharing scheme, to make sure my family can access those secrets in case of my death. I need a way to keep adding secrets (without distributing new shares).
...
- 103
1
vote
1
answer
433
views
Where to store pydrive secret?
Backstory: been toying with the idea of setting up some raspberry pi cctv cameras. originally I was going to store all footage for 31 days (complying with DPA) on a network drive but decided against ...
- 47
2
votes
2
answers
1k
views
Alternatives to hardcoding or encrypting key material in source code
What is best practice as of 2019 for storing secrets inside applications?
Sometimes in an app, you might need to access some web-resource or other asset that requires authentication or decryption.
...
- 689
2
votes
0
answers
149
views
Securing key generation by 3rd parties
I'm working on an IoT product that uses the cloud once finished. Each of these devices has a serial number, from which a key is derived. This key is then stored on the device itself and in the cloud. ...
1
vote
1
answer
700
views
Getting data from AWS Secrets Manager at deployment (ENV variables) vs. at run-time (e.g. aws-sdk)
Given a serverless deployment of some kind (i.e. something that relies on AWS Lambda for computing), and secrets stored in AWS Secrets Manager, what difference from security standpoint is there ...
- 143
0
votes
0
answers
91
views
How secure is this scheme?
Introduction of the cryptosystem
Let's say we have a system with a central server SRV that is considered secure (communication with this server is secured too with TLS).
Then let's say we have many ...
- 119
1
vote
1
answer
759
views
Handling secrets and environmental variables in Docker-k8s-skaffold dev environment
Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it.
Just ...
- 223
1
vote
1
answer
151
views
Securing Code Secrets - What is the relevance if the host gets compromised?
I've been researching and testing different approaches when it comes to securing code secrets, and am unsure what the best options are, and if they even have any relevance once a host gets compromised....
- 135
6
votes
1
answer
4k
views
Where to store secrets in .NET applications?
I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
- 294
8
votes
2
answers
5k
views
IN OAuth 2.0, how is the client secret supposed to be kept secret?
Using most OAuth 2.0 flows, a client application can identify itself to the authorization server by means of a "client id" and "client secret."
The OAuth 2 specification says that the client secret ...
- 1,069
2
votes
1
answer
143
views
Is getpass.io secret-based artwork a threat?
When typing a secret keyword into Getpass, a little jdenticon is showing on the right, based on the secret that was entered. The FAQ on Getpass states the following about it :
Did you notice that ...
- 205
2
votes
0
answers
188
views
Storing users' private keys to clone git repositories on their behalf
Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
- 121
1
vote
2
answers
1k
views
How do you use initialization vector? [duplicate]
My application needs to store some sensitive information. I want to encrypt the data before I store it. At some point in the future, I want to be able to read and decrypt all the data.
For a ...
- 133
0
votes
0
answers
92
views
How should I store and distribute deployment configurations?
When developing web applications that require access to a database, or any other service, they will somehow have to possess a secret like a password or connection string. This secret has to be ...
0
votes
1
answer
826
views
How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?
Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following:
seal "azurekeyvault" {
tenant_id = "46646709-b63e-4747-be42-516edeaf1e14"
client_id = "...
- 640
0
votes
1
answer
895
views
If one HashiCorp Vault Policy allows a capability, and another denies it, how does it decide which Policy to honor?
HashiCorp Vault is an open source tool for secrets management.
I'm using it for this purpose, and have come across a minor issue. I seemingly cannot deny access to a specific API path.
I've tested ...
- 640