[deleted]
Git-secret – store private data in a Git repo
71–74 of 74 posts
Re: Git-secret – store private data in a Git repo
#72This project scares me because it helps foster a bad practice -- keeping secrets in a repo. You really shouldn't be keeping secrets in the repo. You should be using a secrets service that is designed for such a purpose, like Hashicorp's Vault[0], so that you never have to keep a secret in the code. [0] https://github.com/hashicorp/vault
On a sidenote: anyone know how Vault Project built this: it's very cool
Re: Git-secret – store private data in a Git repo
#73Earlier quoted context omitted.
If you use a purpose built storage though then you can deny access to the actual keys to just about everyone, so if a developer leaves then they won't have the keys, and if they do you'll know because it will have a built in audit trail. And in many cases you never have to release the key from the purpose built store because it takes in crypto text and gives out plain text without ever revealing the key to the user.…
What you are describing is how to remove _access_ to the secret. The issue here is, that the former employee still has _knowledge_ of the secret. Hence you have to rotate the secret.
Plenty of companies choose to accept the risk that an employee might have memorized a secret, but not accept the risk that the employee's secret-encrypting-key might leak at any point for the lifetime of the repository.
Obviously, nothing you do w/r/t secret storage is going to resolve the problem of what's in your employees' heads.
Re: Git-secret – store private data in a Git repo
#74This project scares me because it helps foster a bad practice -- keeping secrets in a repo. You really shouldn't be keeping secrets in the repo. You should be using a secrets service that is designed for such a purpose, like Hashicorp's Vault[0], so that you never have to keep a secret in the code. [0] https://github.com/hashicorp/vault
Another option worth considering may be Knox[0] by Pinterest.
> Knox is a service for storing and rotation of secrets, keys, and passwords used by other services.