4 ms·

API integrations are making the internet less secure (opinion piece)

• 8organicbits 3y ago
  > a good practice to minimize damage is to routinely cycle API keys. Anyone have a good measure for how frequently this should be done? Too frequently is too much toil and infrequently is a security risk.
  • mathewpregasen 3y ago
    Keys of higher risk should be done more frequently. How frequently is more a matter of risk (is your company a target?) + engineering bandwidth to do it. All keys should at least be refreshed once a year. At least. It's worth mentioning that refreshing keys could also introduce security risks if you don't have a defined process. For instance, if an engineer is consistently emailing new keys to another engineer, that's probably (most definitely) a bad idea.