Viewing profile — diogomonicapt

Don't disagree; I think what I actually tried to argue for was doing both: segregate data access to a new, minimal, service that also requires a key in an HSM to operate.

You can definitely do this in public cloud HSMs. Azure: https://azure.microsoft.com/en-us/pricing/details/key-vault/ AWS: https://aws.amazon.com/cloudhsm/ The only thing you're not…

My unstated assumption was that when calling something like imagetragick you would be doing the appropriate privilege dropping using setuid and setgid. This is obviously not necess…

The problem is applications unintentionally leaking the ENV. Think a hoptoad exception that attaches the current ENV to the report that sends up to the remote server. Or think abou…

Way better than I could have answered ;)

We explicitly chose not to support secrets as ENV variables, since they are prone to being leaked (child processes inhering parent's env; easy to leak ps -e; bug reports usually in…

- We're working on external store support. First implementation will probably be w/ Vault, but we would love for this to come from the community. - If you have access to the manage…

Exactly. The new version of compose supports defining docker secrets inside of the compose file.

Yes: https://github.com/docker/docker/pull/30637

Thanks! - Exposing secrets as in-memory files has a lot of advantages over ENV variables (harder to leak). - We already started updating a few images (MySQL, for example), so they …

You can make a PCI compliant installation w/ Docker yes.

I think with this release things have come full circle for me. I was part of the team that 5 years ago built Keywhiz at Square, starting the whole "secrets should be files exposed …

Author here, I actually added a footnote exactly because of that fact: https://diogomonica.com/2017/01/11/hitless-tls-certificate-r...

Disclaimer: I work for Docker For the security enthusiasts out there, Docker 1.10 comes with some really cool Security focused additions. In particular: - Seccomp filtering: you ca…

I agree that the title is more link-baity than it should. For what it's worth, part of it was just a witty title.

Agreed. The article did stem from me reading blogposts where people were interpreting the XKCD comic into: just chose four words instead of one password.

I think the answer is not yet. Apple's TouchID is a great example of a frictionless authentication mechanism that can be easily augmented with a password to achieve two different f…