4 ms·
"As Vault is run within our internal network (and for other reasons), TLS is disabled. " No. No. No. No. No. No. This should NEVER be an option. You should not
by mark242 10y ago
"As Vault is run within our internal network (and for other reasons), TLS is disabled. "
No. No. No. No. No. No. This should NEVER be an option. You should not allow data to pass unencrypted over the wire, period.
- czbond 10y agoThank you for doing this before I had a chance to!
- sweis 10y agoYou don't know anything about their internal network. TLS is not the only game in town.
- josegonzalez 10y agoSG Operations member here. We're extremely aware that this isn't ideal, and is more or less the first thing we're working on fixing. It's why we have this listed both under "Causes for Concern" and "Strategic Improvements". The order of those issues isn't done so by importance :)
- deleted 10y ago[deleted]
- losvedir 10y agoC.f. the NSA tapping Google's and Yahoo's internal networks since the data passed in plain text. [0] [0] https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
- user5994461 10y agoTheory: ALWAYS Encrypt. No exception. Don't let software go into production if it's not. Practise: Always encrypt. Aw wait... what do you mean "tls is not supported?" Are you saying that half of our applications have been running on bare HTTP for years?. Mehhhh. Well, all our public accessible websites are running on HTTPS, right? Right. Guess it's only half a disaster after all:(