3 ms·
Does anyone know what is a good practice to create a "vault" - the kind that is used for the Pepper in this case? I have heard of it being a separate, ip res
by sandGorgon 10y ago
Does anyone know what is a good practice to create a "vault" - the kind that is used for the Pepper in this case?
I have heard of it being a separate, ip restricted server with daily changing ip address, etc. A simpler use case would be to store oauth2 tokens or some kind of PII
- shawabawa3 10y agoI've heard before of it just being stored in the codebase. Doesn't add much security but it does mean both the database server and at least 1 of the app servers or the codebase have to be breached
- koolba 10y ago> I've heard before of it just being stored in the codebase. Yuck! At the very least put it in an environment variable. Best case is loaded once at server boot from an HSM, kept only in memory, and rotated on a regular basis. Having it in the code, like all other config, is a terrible idea.
- sandGorgon 10y agoIf we don't have a hsm? Apparently,neither does Dropbox. So how do you engineer one ?
- morgante 10y agoUse something like Vault: https://www.vaultproject.io/ https://www.vaultproject.io/