3 ms·
> If you've lost the database, you've lost accountability for all user actions anyways. Not sure I understand why. Is it because the (hashed) passwords are the
by BoppreH 9y ago
> If you've lost the database, you've lost accountability for all user actions anyways.
Not sure I understand why. Is it because the (hashed) passwords are there too, or did you have an attack against the API keys in mind? Just to be clear, I'm thinking of an unsecured backup scenario, not full blown database compromise.
Regarding signing, that's a good point I hadn't considered, and maybe reason enough not to hash the API keys.
- tptacek 9y agoIn my mental model, you lose the database to appsec flaws, not to opsec flaws with backups. Both things definitely can happen! I'd suggest though that losing your entire (auth) database to a compromised backup is a "reset all the API keys" moment anyways. Remember: these services that provide API keys are invariably backed with some kind of login service that uses passwords. Even if you're hashing with scrypt, if you lose the password hashes, everyone's resetting creds.
- ronnier 9y agoIsn’t the issue the time when you’ve lost your dB and the time you realize it? During that time keys could be used.