3 ms·

I saw an interesting approach to this described in a blog comment a while back. I've been pondering it ever since: http://ejohn.org/blog/keeping-passwords-in-

• ukd1 13y ago
  Interesting, resig's approach doesn't work with continuous deployment, unless you want to decrypt stuff each build (which would be less secure). Ntnt's solution sounds awesome but imho over kill - a whole extra server?
  • hamburglar 13y ago
    Personally, I'd happily deploy an extra server or two (redundancy) to keep from having credentials laying around unencrypted on production machines.
    • ukd1 13y ago
      This is dumb. If they need a secret, they request them using another key. Therefore they have access to all the secrets they would have needed anyway. What does this gain? It adds a ton of complexity and a major failure point.
      • hamburglar 13y ago
        The interesting part to me is leveraging the ssh agent. Yes, the secrets are all behind yet another key, but it happens to be a key that doesn't leave your local machine even when it's being used to get access to a remote secret, plus it's a key that you likely already have set up (and hopefully secured) for ssh access.