4 ms·
Not an answer, but I do wish there was a low level primitive and a corresponding high level language construct to pass around secrets. Something like: my_secre
by vendiddy 1y ago
Not an answer, but I do wish there was a low level primitive and a corresponding high level language construct to pass around secrets.
Something like:
my_secret = create_secret(value)
Then ideally it's an opaque value from that point on
- 1718627440 1y agomy_secret = getenv ("VALUE"); :-)
- jkrejcha 1y agoUntil when? Secrets in applications in many cases (I would probably wager majority of the cases) are only useful if they're in plaintext at some point, for example if you're constructing a HTTP client or authenticating to some other remote system. As far as high-level language constructs go, there were similarish things like SecureString (in .NET) or GuardedString (in Java), although as best as I can tell they're relatively unused mostly because the ergonomics around them make them pretty annoying to use.
- vendiddy 1y agoJust seeing this now. The thinking was to minimize the the places where a secret could leak. So with an HTTP client, I would think at the lowest layer possible. I don't think of it as a way to eliminate secrets leaking. More-so reducing the surface area of accidental leaks.