Secret Management with Vault

Re:Secret Management with Vault by mark242 on Friday October 28, 2016 @05:56PM (#12821097)

"As Vault is run within our internal network (and for other reasons), TLS is disabled. "

No. No. No. No. No. No. This should NEVER be an option. You should not allow data to pass unencrypted over the wire, period.

[ Parent | on HN ]

Re:Secret Management with Vault by josegonzalez on Friday October 28, 2016 @06:42PM (#12821379)

SG Operations member here.

We're extremely aware that this isn't ideal, and is more or less the first thing we're working on fixing. It's why we have this listed both under "Causes for Concern" and "Strategic Improvements". The order of those issues isn't done so by importance :)

[ Parent | on HN ]

Re:Secret Management with Vault by losvedir on Friday October 28, 2016 @08:37PM (#12821945)

C.f. the NSA tapping Google's and Yahoo's internal networks since the data passed in plain text. [0]

[0] https://www.washingtonpost.com/world/national-security/nsa-i...

[ Parent | on HN ]

Re:Secret Management with Vault by user5994461 on Saturday October 29, 2016 @11:10AM (#12824257)

Theory: ALWAYS Encrypt. No exception. Don't let software go into production if it's not.

Practise: Always encrypt. Aw wait... what do you mean "tls is not supported?" Are you saying that half of our applications have been running on bare HTTP for years?. Mehhhh. Well, all our public accessible websites are running on HTTPS, right? Right. Guess it's only half a disaster after all:(

[ Parent | on HN ]

Re:Secret Management with Vault by sweis on Friday October 28, 2016 @06:38PM (#12821362)

You don't know anything about their internal network.

TLS is not the only game in town.

[ Parent | on HN ]

Re:Secret Management with Vault by czbond on Friday October 28, 2016 @06:33PM (#12821337)

Thank you for doing this before I had a chance to!

[ Parent | on HN ]