Git-secret – store private data in a Git repo

Re:Git-secret – store private data in a Git repo by tptacek on Monday May 09, 2016 @06:49PM (#11663861)

No. If that were the case, there would be no purpose to rotating keys. The problem is that despite rotating keys, your old crypto keys have permanent access to secrets, because the old ciphertexts are by default retained in the git history.

It's a bad idea to store secrets in any form in your source code repository.

[ Parent | on HN ]

Re:Git-secret – store private data in a Git repo by startling on Tuesday May 10, 2016 @02:02AM (#11665414)

I think what grandparent and others are saying is that you also revoke the secrets contained in the ciphertext, e.g. if it's an AWS key you would revoke that AWS key on AWS's side as well as encrypting new secrets with a different encryption key.

Obviously this is a huge hassle and isn't easily done with all kinds of secrets (which is what I think you're getting at?). But it's also often necessary.

[ Parent | on HN ]