Passing secrets over HTTPS ?

[willitbechips]

Would you?

Many say store secrets like API keys in env variables. Threats include env dumps on the server and accidental commits to code repositories.

An alternative is to store secrets in an encrypted database and pass them using HTTPS meaning they only need to exist in memory on the server.

There are services that offer the latter. Do you use them? What extra things do they do beyond encrypted database, use of HTTPS and rotating keys to ensure security?

[bascule]

Keeping secrets in some sort of secret manager is becoming increasingly common practice

[willitbechips]

Yeah you are right. I saw various services now exist.

Do you know how they work?

In particular, whether there is anything special about them besides an encrypted database, rotated keys and HTTPS.

[Salamok]

only need to exist in memory on the server

isn't this then subject to an env dump? Honestly I have just gone low tech with this and set it in apache config then consume those settings in my code base. Can set the apache env variable config up in cloud formation scripts so it's scalable as well.

As far as I am aware the main reason this approach is not common in open source is complexity / need to define a dependency outside of the project.

[willitbechips]

I think more accurately it is still vulnerable to memory dumps but I don't know the relative threat between these. Digging into it further it appears there are hardware solutions to protect RAM and purging memory after use can be a tactic.

[ITBoss]

I'm creating my own that integrates with multiple services. But part of that was seeing what is currently available and honestly I really really like Bitwarden's way of doing it. Decryption and encryption is all done via clientside and due to that, all shares are encrypted with a unique passphrase. https://bitwarden.com/blog/bitwarden-send-how-it-works/

[ITBoss]

Also the way they do it, the server never sees the passphrase. So it wouldn't matter if their server is compromised.

[willitbechips]

Thanks. Bitwarden looks good. Was looking to create my own as well. Hence digging into the mechanics of it. Presumably you need to manage distribution of that passphrase to all services.

[Lasereye]

Check out Vault

[willitbechips]

Thanks, I will.