Heroku Security Notification • Hacker News Board

Re: Heroku Security Notification

#121

Post by maccard » Mon, Apr 18, 2022, 11:31 AM UTC

nijave wrote: post #98

maccard wrote: post #48

Earlier quoted context omitted.

at work thats fine, we use vault or secrets manager, but neither of those are really suitable for self hosting for toy apps. What do you tell someone using github's free tier and aws/gcp's free tier?

You can store them in the repo and encrypt them with Mozilla sops. You can use a cloud managed key like AWS KMS or a GPG key. If you manage your own key, you can store it in a password manager or use a USB hardware key to store it You could also use object/blob storage or your local filesystem to store a config file and optionally apply encryption to that

You've just moved the problem from storing the secret to storing the key in that case though. For AWS KMS, you're now paying [0] for the key storage, and if you use a GPG key, you still need to get it into the application somehow.

[0] https://aws.amazon.com/kms/pricing/

Re: Heroku Security Notification

#122

Post by lumberjack24 » Thu, Apr 21, 2022, 2:00 PM UTC

Ozzie_osman wrote: post #90

I'm not a security expert, but if you're reading this and wondering what to do, a good start could be to just assume your repo was accessed, and so to run a tool like gitleaks against your repo. If it detects anything sensitive, I'd see about revoking/deleting those secrets right away. In general, it's good practice not to check anything sensitive into source code for precisely this reason (if your code is compromise…

A few days before this attack campaign started, I wrote a guide to help security and engineering teams prioritize and remediate thousands of secrets-in-code incidents.

Hope it can help some of the organizations dealing with this right now!

https://blog.gitguardian.com/a-practical-guide-to-prioritize...

Re: Heroku Security Notification

#123

Post by nijave » Fri, Apr 22, 2022, 9:18 PM UTC

maccard wrote: post #121

nijave wrote: post #98

Earlier quoted context omitted.

You can store them in the repo and encrypt them with Mozilla sops. You can use a cloud managed key like AWS KMS or a GPG key. If you manage your own key, you can store it in a password manager or use a USB hardware key to store it You could also use object/blob storage or your local filesystem to store a config file and optionally apply encryption to that

You've just moved the problem from storing the secret to storing the key in that case though. For AWS KMS, you're now paying [0] for the key storage, and if you use a GPG key, you still need to get it into the application somehow. [0] https://aws.amazon.com/kms/pricing/

If you're using a GPG key, you don't necessarily need it to leave your PC. You just need to "re-deploy" the secrets manually when they change from a place that has access to the key