4 ms·

Here's what I see happen with Vault in actual real world usage. Applications use the token auth method with extremely long lived tokens, and then the auth toke

Here's what I see happen with Vault in actual real world usage. Applications use the token auth method with extremely long lived tokens, and then the auth tokens are stored in source or in config files or whatever. It just moves the problem and makes it look better because they aren't called "passwords"

zie 8y ago
This is absolutely not how WE use it, but I'm sure lots of people do stupid stuff like that. We actually deploy vault tokens to every user(happens at login time, since login authentication happens against vault). So we can deploy secrets directly to end users using vault policy. Applications that are not ran/started directly by the user find other means of getting their secret 0(VAULT_TOKEN), usually through nomad, but in the rare case it's a standalone application not run under nomad, we seed the startup with a token by hand, and then have a process handle renewals, etc.
mahmoudimus 8y ago
This is a very real problem. In my mind, the problem with security today is there is no convention over configuration. The current state of the art of vendors today is very much "here's a bigger gun, figure out how to defend yourself." Think back, in 2005, how Java and XML configuration vs Ruby on Rails -- convention over configuration was very much a big change in how we, as software developers, were thinking. We need something similar in the security space.