3 ms·
The problem domain here involved getting a private key on a user's machine, and a public key in a location it can be pulled from to grant access. Your proposed
by iso1631 5y ago
The problem domain here involved getting a private key on a user's machine, and a public key in a location it can be pulled from to grant access.
Your proposed solution, as correctly pointed out in stack overflow, is a security nightmare.
> I should point out here that passing private keys around is generally a bad idea and you'd be much better having developers create their own key pairs and provide you with the public key that you (or them) can use to generate an AWS key pair
- orf 5y agoI mean, yes, but not really. They are clearly in a corporate environment and it wouldn't be unusual to say that the company needs access to your private keys you use to do work for said company. Just like they would have access to your laptop, and likely the disk encryption keys on it as well. Using 1Password as a middleman here is quite convenient - it's a secure encrypted way of transfering them to the user that is accessible to the company when/if they need it.
- iso1631 5y agoWhat dystopian place do you work in? That would be like saying the company needs access to your password!