Hacker News Reader

Comment by AlwaysNewb23 | Hacker News Reader

I've relied on .env files or just my notes in the past and I have two concerns I'd like to fix: 1. It's hard to share secrets and it's hard to keep everyone in sync. 2. The secrets are just there in plain text and that seems like a nightmare waiting to happen.

View on HN

1. Limiting access for crutials secrets: to access an vault you need credentials, but if you encrypt it you need another and so on, so the absolutly lowest should be stored securly with the least possible access. 2. An secret you don't have is save. So removing an secret from ram if you don't need it. Useful for an pool of persistent database connections. 3. If you need it at multiple places or you don't know were its accessed, store it at an central location(for example a cluster) that stores the secrets at rest.

a hashicorp vault you change your secret there and every supporting application can retrieve it from there and use it. once they are done they delete it from the ram. If you can/want use specific kernel apis i would propose keyctl( https://www.man7.org/linux/man-pages/man2/keyctl.2.html ) this apis can store secrets limited to an specific range(threat, process, user, ...) outside of the process.

Hashicorp Vault or (AWS|GCP) Secrets Manager would be the common answer.

There is also the startup Doppler (https://www.doppler.com/) that is directly taking on the Hashicorp Vault space. It’s probably easier to get up and running and friendlier for a smaller team. No affiliation!

Reply on news.ycombinator.com