Announcement discussion

[printercu]

https://github.com/printercu/secure_credentials/wiki/Rails-5.2-credentials-are-not-secure

[maxence33]

I think you are correct, I have asked a similar question on Stackoverflow https://stackoverflow.com/questions/50847451/rails-new-credentials-creates-greater-risk-in-case-of-master-key-is-corrupt Your gem is probably fixing the security issue but actually I think the old secrets.yml + Heroku environment variable is yet the easiest (and equally secure) solution. I just hope future versions of Rails will still support secrets.yml

[printercu]

I think key feature of encoded files is that credentials are stored and modified in single place (app's repo) - there's no need to edit secrets.yml on production via ssh or in orchestration repo. secrets.production.yml.enc is just commited along with secrets.sample.yml, and there are always required credentials on every deploy.

[printercu]

According to compromised master.key in case of theft. I think that it should be stored in system encrypted store, like a keychain or encrypted disk volume. This will prevent from decoding encrypted secrets/credentials.

[tommyalvarez]

Isn't this a statement similar as to saying that AWS ssh access is insecure because the .pem key file may be stolen from your computer ?
You're suppose to only commit the encrypted yml file and NEVER the master key file. The master key should be set by enviroment variable directly in production server and sent to other team members by a secure method, encrypted email, telegram, usb, etc... I agree there should be an encrypted credentials file for each enviroment though.

[printercu]

If high security level is required then private keys must be stored encrypted. It can not be used without password when stolen.

The difference with master.key is that private key is not required for development and access to it can be restricted. While every developer should have access to master.key when there is Rails.application.credentials... in the code.

[maxence33]

I think Rails 6 will have different environments credentials.

[printercu]

Yes. Maybe even in 5.2.x - rails/rails#33521
However I don't like idea encrypting dev secrets by default. Who knows, may be this also be changed one day.