They come with the job. ● Terrible at parties! ● Super useful otherwise. ● Shared thousands of times a day! ● Changing all the time! Let’s make them work! We’ve all got one. ● Great for parties! ● Fun way to burden a friend! ● Share it once, regret it always! ● We all know what you did last summer. Try to forget! Family Secrets Dev Secrets
Secret mismanagement Approach 1: Put them in the code The easiest and earliest form of integration. Hope you trust your host! Approach 2: Put them in the config A settings.py or config.json is no more secure than your code. And now you’ve probably got two problems. Approach 3: Put them in the environment You’re going to get tired of entering them, lose them, or both.
Secret management Approach 1: Password managers LastPass, KeePass, etc. focus on the individual consumer and don’t work great for teams. Approach 2: Key management services Enterprise solutions like Vault and Hardware Security Modules (HSMs) don’t scale down. Approach 3: Encrypted source control git-crypt and friends scale down, but are cryptic to use and easy to misconfigure.
Pocket Protector concepts Domains: Namespaces Enables organizing keys by app and environment. Key custodians: Registered users Pocket Protector leverages your repo’s write protections capabilities. Anyone can write to the file, but presumably only authorized users can push. Key custodians have passphrases that will allow them to read from the file. Owners: Registered users with read access to a domain Adding a key custodian to a domain grants them read access to the secrets in that domain.
Pocket Protector $ pprotect --help usage: pprotect [COMMANDS] Commands: add-domain add a new domain to the protected add-key-custodian add a new key custodian to the protected add-owner add a key custodian as owner of a domain add-secret add a secret to a specified domain decrypt-domain decrypt and display JSON-formatted cleartext for a domain init create a new pocket-protected file list-all-secrets display all secrets, with a list of domains the key is present in list-audit-log display a chronological list of audit log entries representing file activity list-domain-secrets display a list of secrets under a specific domain list-domains display a list of available domains list-user-secrets similar to list-all-secrets, but filtered by a given user rm-domain remove a domain from the protected rm-owner remove an owner's privileges on a specified domain rm-secret remove a secret from a specified domain rotate-domain-keys rotate the internal keys for a particular domain (must be owner) set-key-custodian-passphrase change a key custodian passphrase update-secret update an existing secret in a specified domain Options: -h, --help show this help message and exit $ pprotect --help Lots more subcommands for people-centric secret management . Beyond the deck Functionality galore!
Pocket Protector Today: ● Way better than the alternatives ● Currently in multi-app, multi-environment use at SimpleLegal ● Available on PyPI and GitHub Planned features: ● Quorum-based recovery features (Shamir) ● Support for more types of secrets! ● Fancy new CLI using Face Try it out! Next steps
Progress - Topic area 1 Accomplishment 1 ● Lorem ipsum dolor sit amet, consectetur adipiscing elit ● Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Accomplishment 2 ● Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. (Secrets tell you which one is real)
Progress - Topic area 1 Accomplishment 1 ● Lorem ipsum dolor sit amet, consectetur adipiscing elit ● Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Accomplishment 2 ● Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. So you get real Data
mhashemi
pospome
uhooi
yusukebe
rakus_dev
codehex
takamin55
skanehira
ivargrimstad
okuzawats
gregonnet
hitsuji1991
tomokusaba
sonatard
chrislema
danielanewman
bkeepers
robhawkes
paigeccino
destraynor
michaelherold
jnunemaker
colly
notwaldorf
aleyda