3 ms·
Enter the Vault: Authentication Issues in HashiCorp Vault
- ccktlmazeltov 6y ago> Both vulnerabilities (CVE-2020-16250/16251) were addressed by HashiCorp and are fixed in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1 released in August. I never understood why people use Vault. Putting all your secret in one place is just the best possible situation for an attacker.
- jiveturkey 6y agoguess you don't get out much. please describe your system and how it is universally better, at the scale at which Vault is designed to operate. (pricing starts at around $150k annually, as a proxy for scale where Vault matters)
- snoshy 6y agoThe alternative would be to scatter your secrets across several different stores, each of which would have their own security boundaries. In quite a lot of backend systems, you're only as strong as your weakest link. Now you're in a situation where you have to audit the attack surface of several different systems, so I'm not sure how Vault would be particularly worse at this task. I would wager a larger portion of security incidents due to security products being harder to use correctly, and Vault is one of the cleaner and easier-to-use solutions in this regard, so I still think it's a step forward.
- merb 6y agowe use vault for certificate generation
- GauntletWizard 6y agoYou got a bunch of downvotes, but I agree. Properly scoped secrets are scoped per team. There’s a significant management issue - But it scales with scope. Each team should be aware of all the teams it interacts with, both inbound and outbound, and manage their own tokens. Concentrating them all in one place with systems like Vault is pretty dangerous. You should use one tool across your company, but you should use many installations of that one tool. What Vault can be good at is certificate generation or management of short-lived certificates; Using Vault to generate you temporary AWS credentials or certificates can be really powerful. Carefully scoping those, though, is not something I’ve seen most teams do.
- ccktlmazeltov 6y agoI think most people in this thread work in AWS or GCP and there it doesn't matter really because every thing is a blackbox that magically connects with other blackbox via magical identities.
- commandlinefan 6y agoThis blog post is the first clear explanation of how Vault actually works I’ve ever come across (and I’ve spent a LOT of time trying to make sense of it from Hashicorp’s documentation).
- jsiepkes 6y ago> For Vault, this turns into a security issue due to a somewhat surprising feature of the Go XML decoder: The decoder silently ignores non XML content before and after the expected XML root. I mean....Wow... I seriously wonder what the design consideration for the API of the XML decoder in Go was that they thought it was a good idea to simply ignore the stuff which is clearly invalid XML instead of erroring out. If I recall correctly it's even invalid XML to have a line break before the xml document declaration. But I guess in Go that would also be valid? These are exactly the kind of gotcha's in API's and languages that create security issues like these.
- ccktlmazeltov 6y agoalso why XML...