4 ms·
Now this is interesting. Could we imagine a service that would be in charge of protecting your customers secrets? You would provide a list of secret strings, a
by MasterScrat 13y ago
Now this is interesting. Could we imagine a service that would be in charge of protecting your customers secrets?
You would provide a list of secret strings, and ask to have them monitored on search engines but also from mobile applications, browser extensions, published JARs etc.
- TheLoneWolfling 13y agoNOOOOOOOOOOO But seriously, treat them like passwords. Don't have the service store the secrets, have the service store hashes of the secrets with a regex for prefiltering (because hashing every word everywhere would be prohibitively expensive).
- MasterScrat 13y ago> Don't have the service store the secrets Why not? You can use the service to make sure it doesn't leak its own secrets so it's safe ;-) But seriously yes I really like your approach. You could even provide a second set of API to do the opposite: given a block of text see if there's any sensitive string inside. Google & co could use it before publishing an app in their Store.
- michaelmior 13y agoEither way you still have to trust another third party to keep your secrets safe. Even if the secrets weren't publicly leaked, any comrpomise to this service affects any service whose keys you have stored there.