3 ms·
It is long past time for channel-binding of bearer credentials. It's unconscionable we as engineering professionals allow the total sum of security controls of
by 0daystock 4y ago
It is long past time for channel-binding of bearer credentials. It's unconscionable we as engineering professionals allow the total sum of security controls of a system to constantly be reduced to a string humans pass around.
- judge2020 4y agoOIDC-based authorization between trusted parties seems to be picking up steam[0], with the main issue being that setting it up isn't as easy as "paste shared secret". 0: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services https://docs.github.com/en/actions/deployment/security-harde...
- tedivm 4y agoI wrote a blog post about connecting Github and AWS over OIDC. In my example I focus on using it to public images to ECR, but it's applicable to any AWS permission needs. https://blog.tedivm.com/guides/2021/10/github-actions-push-to-aws-ecr-without-credentials-oidc/ https://blog.tedivm.com/guides/2021/10/github-actions-push-t...
- capableweb 4y agoI agree, but even so, you can make things a lot more secure from "having plaintext credentials commit to source code versioning" without changing your entire infrastructure, which a move like that would require. Simply use environment variables and a .env file.