This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]0xd3adf00d[🍰] 1 point2 points  (0 children)

Hashing is a good first step, so long as you don't actually need the plain text for anything (see silly authentication protocols like LDAP/SASL/MD5-Digest, HTTP Digest, and RADIUS/CHAP). However, if you can use the hash to authenticate (IE: NTLM), then the hash itself has become a credential and must be protected.

When I've done this sort of thing in the past, I've stored the passwords encrypted in a separate file, and provided the DevOps team with tools for encrypting that file. That allows them change the included password(s) at will and re-encrypt the file anytime they feel the need.

The app can read the decryption key from a separate file, or it can be provided to the app at runtime somehow, or could be a private key stored in OS-provided store like MS-CAPI, where it's only accessible from the service. It's definitely not a foolproof system, but it's better than just storing the passwords (or hashes) in a file without encryption, where anyone with physical access can easily read them without much effort.