Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Keep it Secret, Keep it Safe

Keep it Secret, Keep it Safe

Managing passwords in userland is tricky enough, but clever tools like 1Password and LastPass have made it easier than ever to protect our social media accounts. Two-factor authentication tools have made us safer still by preventing even weak password from being easily bypassed. Unfortunately, none of this helps us with passwords and credentials in our code.

First, we’ll define the threat models that affect secret data within our PHP apps – and how this sensitive information could be exploited. Then, we’ll survey the landscape of tools available to manage secrets safely so our data stays secure. Finally, we’ll work through the code required to tie everything together and keep our access keys both secret and safe from nefarious third parties.

Eric Mann

June 02, 2017
Tweet

More Decks by Eric Mann

Other Decks in Technology

Transcript

  1. $ pip install credstash $ credstash setup $ credstash put

    database_connection_string mysql:dbname=testdb;host=127.0.0.1 $ credstash put database_user user $ credstash put database_pass password
  2. <?php require('vendor/autoload.php'); $sdk = new Aws\Sdk($config); $credstash = CredStash\CredStash::createFromSdk($sdk); $dsn

    = $credstash->get('database_connection_string'); $user = $credstash->get('database_user'); $pass = $credstash->get('database_pass'); $dbh = new PDO($dsn, $user, $pass);
  3. # .env DATABASE_CONNECTION_STRING="mysql:dbname=testdb;host=127.0.0.1" DATABASE_USER="user" DATABASE_PASS="password" # .gitattributes .env filter=git-crypt diff=git-crypt

    # .env ^@GITCRYPT^@<84>±<9b>ÅÛ4^M$<9a><9f><8d>Y<87><89>"-^Cb¦@T<90>¬ ÉL%s^^_^Yð^AY<84>^[ÿ³ú}È<- ÞG/{OXTé¹¾<87>Ôï3c<93>_IpÀjñA^_µÅ^T<88>îm]ëk^Txbq¢^E^DÐËSªJ8³{öRè_|":6~ ¥ý<90>^Nóp¢ô^R2X^US ^VÓÀ¾£ú¤ $ brew install git-crypt $ cd ~/project $ git-crypt init $ git-crypt add-gpg-user 715376CA
  4. <?php require('vendor/autoload.php'); $dotenv = new Dotenv\Dotenv(__DIR__); $dotenv->load(); $dsn = get_env('DATABASE_CONNECTION_STRING');

    $user = get_env('DATABASE_USER'); $pass = get_env('DATABASE_PASS'); $dbh = new PDO($dsn, $user, $pass); $ git-crypt unlock
  5. • HASHICORP'S BLOG • FUGUE'S BLOG • AWS KEY MANAGEMENT

    SERVICE • PARAGON INITIATIVE'S BLOG • TOZNY'S BLOG