Store file mounted secrets as hashed values #5509
rajithacharith
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Problem
When we generate a security key on setup and hand it to the user, the current instinct is to persist the key itself in a file so it can be validated later. That means if an attacker gets access to the file system, these secrets can be seen as plain-texts.
Example secrets: Direct Auth secret
Proposed approach
These file mounted secrets will be stored as hashed values. Then, whoever gets access to these will not be able to attack the system as the original value cannot be derived from the hash.
Note: This can be only done for secrets used in verification purposes.
All reactions