4 ms·
I'd love to see some concrete suggestions on the right way to do security for a site like this. This would take far more than protecting a few web pages from un
by paulsutter 14y ago
I'd love to see some concrete suggestions on the right way to do security for a site like this. This would take far more than protecting a few web pages from unauthorized access. What else should they do? How should they store sensitive data like AWS keys? Should they include a feature to force the creation of a new temporary key to prevent users from naively storing their master key? Is there a better mechanism than storing the key?
- gfodor 14y agoOne appropriate way to do this is to not build this type of application as a web service, but instead as a standalone application. (Disclaimer: I haven't really tried this product, for obvious reasons.)
- rdl 14y agoI've been working on a similar kind of problem (linking to AWS); the right thing is to walk users through IAM credential creation (if you must have the keys), explaining exactly what rights are needed, why, and how to verify, and to not take anything more than you need. I'd also encapsulate use of any user-provided sensitive data in an API then called by your service, and put some logic within the API (because I don't want a random web UI screwup to dump everything for everyone) -- rate limits, etc.
- rdl 14y agoI've been working on a similar kind of problem (linking to AWS); the right thing is to walk users through IAM credential creation (if you must have the keys), explaining exactly what rights are needed, why, and how to verify, and to not take anything more than you need.