4 ms·
You almost certain should be storing your keys encrypted with a decent passphrase.
by msbarnett 7y ago
You almost certain should be storing your keys encrypted with a decent passphrase.
- macspoofing 7y agoAnd if you want headless access this passphrase will be stored unencrypted. This is nothing more than security Kabuki theater.
- simlevesque 7y agoWell, yeah, some keys must be unencrypted to be useful. But in a lot of cases you can and should encrypt your keys used to do manual stuff.
- asadlionpk 7y agoIn this scenario, wouldn't that mean the user will have to enter a passphrase on each Trello boot to be able to use it? (ask for passphrase -> decrypt auth token -> Access API)
- simlevesque 7y agoNo, you use ssh-agent.
- macspoofing 7y agoOr you can restrict the file with the key to a specific user and only run the process as that user. The point is, you haven't actually solved the problem. It's not magic. In a 2-system authentication scheme, where headless access is necessary, a key needs to be somewhere in plaintext accessible to the process. You can obfuscate this, or add OS controls, or hardware chips, or ssh-agent, or keystores, or web-services for keys, but it doesn't change this reality.
- msbarnett 7y agoIndeed if you want to do something stupid, something stupid will be the result