Be nice, help the person who hacks your servers to get your data
summary
Cleartext credentials leak everywhere: 1,800 unique keys daily and 4.1 billion records exposed in six months, with real-world fallout like a $15,000 bill from leaked AWS keys. Practical fixes use secret managers (AWS Secrets Manager, HashiCorp Vault) with Vault with Shamir unseal, dynamic short‑lived credentials, ACL policies and HTTP token flows. Vault-based setups work but require unseal procedures, handle latency from HTTP calls, and incur cost tradeoffs; rotating tokens and tripwires drastically reduce liability and recovery time.
AI-written summary · about
chapters (40)
- 0:00Intro
- 0:25Who am I
- 1:02Title
- 1:13Story
- 2:28First contact
- 3:05Expectations
- 3:35Agenda
- 4:28Take off your developers hat
- 4:39Why is this important
- 5:06The second reason
- 5:38Security is not simple
- 5:55Data points
- 6:28Data breaches
- 6:40Common ways of revealing secrets
- 6:59Third party gain access
- 7:23Tripwire system
- 8:25You have it
- 9:12A story
- 10:26You are not using Bureau
- 11:40You are using Docker
- 12:25You should keep in mind
- 13:11But if youre working on a project
- 13:36Liability and criminal negligence
- 14:54Insurance
- 15:40Certification
- 16:13Cost and Security
- 16:35Secret Management Applications
- 17:20Ease of changes
- 17:50Dynamic secrets
- 18:53Backend
- 19:11Costs
- 19:42Tools
- 20:12Secrets Manager
- 20:52Example
- 21:34Hashing
- 21:44Good fit
- 23:54Policies
- 24:30HTTP requests
- 24:57Unsealing
- 25:33HTTP calls
related talks
39mSecrets Management: How to (not) help the person who hacks your servers get your data
29mBehind Closed Doors: Managing Passwords in a Dangerous World
14mSecurity lifecycle management in a multicloud world
26mHow To Keep A Secret
27mWho's managing the credential for your data infrastructure?
40mA Better Way To Manage Secrets
24mHow to Find if Your Developers are Leaking Secrets?
46mThe Nightmare for Attackers: An Infrastructure without Secrets