Environment Variables Considered Harmful for Your Secrets

Re:Environment Variables Considered Harmful for Your Secrets by mreinsch on Friday January 02, 2015 @05:00AM (#8826252)

I agree that ENV variables are useful for general configuration, that's exactly what they were invented for...

ENV variables are not restricted by user though, your process can spawn another process under a different user and give it the same environment. It's the nature of the environment that it is usually inherited from the parent which causes the issues when we're talking about secrets.

[ Parent | on HN ]

Re:Environment Variables Considered Harmful for Your Secrets by geocar on Friday January 02, 2015 @05:44AM (#8826341)

Delete sensitive environment variables after you read them, or don't run programs you don't trust with an unsanitary environment/argument list (e.g. execve not system)

[ Parent | on HN ]

Re:Environment Variables Considered Harmful for Your Secrets by mreinsch on Friday January 02, 2015 @05:54AM (#8826360)

Thanks for that idea of deleting sensitive environment variables. I like that for hosters such as heroku which use ENV variables for config (including secrets) by default.

[ Parent | on HN ]