Hiding the key
-
The domain performs authentication for the user. The user provides the username and password to the domain.
And the user can share their password, have it hacked, etc. Still not secure.
-
And the user can share their password, have it hacked, etc. Still not secure.
As has always been the case. The user has to know his/her password and might write it on a sticky note or something. That can never be fully secure. Consider a building with many doors and the janitor has copies of all the keys, locked in a box. But the key for that box can't be in the box, it has to be somewhere else, usually in the janitor's pocket. If that one key gets stolen, the thief has access to all of the other keys. The janitor can lock the lockbox key in another box, but then the key to that box might get stolen. It's never-ending. There will always be some nth item which might get stolen and may then provide access to all of the other items like dominos. I have no idea how someone can possibly think that anything can be fully 100% secure. The concept is a fallacy.
-
As has always been the case. The user has to know his/her password and might write it on a sticky note or something. That can never be fully secure. Consider a building with many doors and the janitor has copies of all the keys, locked in a box. But the key for that box can't be in the box, it has to be somewhere else, usually in the janitor's pocket. If that one key gets stolen, the thief has access to all of the other keys. The janitor can lock the lockbox key in another box, but then the key to that box might get stolen. It's never-ending. There will always be some nth item which might get stolen and may then provide access to all of the other items like dominos. I have no idea how someone can possibly think that anything can be fully 100% secure. The concept is a fallacy.
Not 100%. Just reasonably secure. That is why Azure (and I am sure AWS and others) have the kind of authentication that doesn't require an app storing the means of authentication.
-
Hi all, I have a question based on the below hypothetical scenario. I have an Azure based system comprised of: Web app (Blazor) Multiple Azure functions A set of C# library NuGets written to support shared code Azure SQL Internal-only APIM External APIM (for mobile apps and third Party subscriptions) Azure Front Door Various Azure services, like Key Vault, Azure Storage, etc. ADO DevOps (incl. ADO Git repos, not GitHub, pipelines, artifacts, testing, etc.) ADO Boards for case management Developers use VS 2022 with access Secure information that apps use like keys, usernames/passwords, etc. are stored in a key vault. Now, for the question. What process do you recommend for the apps (not directly publicly accessible other than port 80 HTTP for the web UI) to access the key vault without leaving any keys in config files that could be compromised? I know what I think, but if I knew everything 100% correctly, I probably wouldn’t be here. 🙂 Thanks in advance.
-
Hi all, I have a question based on the below hypothetical scenario. I have an Azure based system comprised of: Web app (Blazor) Multiple Azure functions A set of C# library NuGets written to support shared code Azure SQL Internal-only APIM External APIM (for mobile apps and third Party subscriptions) Azure Front Door Various Azure services, like Key Vault, Azure Storage, etc. ADO DevOps (incl. ADO Git repos, not GitHub, pipelines, artifacts, testing, etc.) ADO Boards for case management Developers use VS 2022 with access Secure information that apps use like keys, usernames/passwords, etc. are stored in a key vault. Now, for the question. What process do you recommend for the apps (not directly publicly accessible other than port 80 HTTP for the web UI) to access the key vault without leaving any keys in config files that could be compromised? I know what I think, but if I knew everything 100% correctly, I probably wouldn’t be here. 🙂 Thanks in advance.
As per generally accepted usage, I put the key content on a yellow sticky note where my computer webcam can see it and route it up to the app. ;)
-
Hi all, I have a question based on the below hypothetical scenario. I have an Azure based system comprised of: Web app (Blazor) Multiple Azure functions A set of C# library NuGets written to support shared code Azure SQL Internal-only APIM External APIM (for mobile apps and third Party subscriptions) Azure Front Door Various Azure services, like Key Vault, Azure Storage, etc. ADO DevOps (incl. ADO Git repos, not GitHub, pipelines, artifacts, testing, etc.) ADO Boards for case management Developers use VS 2022 with access Secure information that apps use like keys, usernames/passwords, etc. are stored in a key vault. Now, for the question. What process do you recommend for the apps (not directly publicly accessible other than port 80 HTTP for the web UI) to access the key vault without leaving any keys in config files that could be compromised? I know what I think, but if I knew everything 100% correctly, I probably wouldn’t be here. 🙂 Thanks in advance.
I may be missing something, but why wouldn't 2 factor authentication work?
Just call me obtuse...
-
this is what chatGBT has to say :
Quote:
To securely access the Key Vault from your applications without exposing the secrets in config files, you can leverage Azure Managed Service Identity (MSI) feature. Managed Service Identity (MSI) is a feature of Azure Active Directory that provides Azure services with an automatically managed identity in Azure AD. With MSI, Azure services can authenticate with other Azure services that support Azure AD authentication, without requiring you to manage any secrets or credentials. The process for accessing the Key Vault using MSI can be summarized in the following steps: Enable the MSI feature for your Azure App Service/Web App: Enable the system assigned identity for your Web App by turning it on in the Identity blade of your Web App. Add access policy to Key Vault: Once MSI is enabled, navigate to your Key Vault, select the Access policies blade, and add the necessary permissions to allow your Web App to access the Key Vault. Modify your code to use MSI to authenticate with the Key Vault: In your code, you can use the Azure.Identity NuGet package to authenticate with the Key Vault using the MSI endpoint. Here's some sample code that demonstrates how to access a secret in a Key Vault using MSI:
var credential = new DefaultAzureCredential();
var client = new SecretClient(new Uri("https://{keyvault-name}.vault.azure.net/"), credential);
KeyVaultSecret secret = await client.GetSecretAsync("secret-name");
string secretValue = secret.Value;BernardIE5317 wrote:
leverage Azure Managed Service Identity (MSI) feature
This is the proper way to use KeyVault.
There are no solutions, only trade-offs.
- Thomas SowellA day can really slip by when you're deliberately avoiding what you're supposed to do.
- Calvin (Bill Watterson, Calvin & Hobbes) -
And by what is the app validated to the KV, and where is that stored outside the KV where the app can access it?
You would probably use Active Directory, with the app running under an account (you can have the system generate one), then providing read access to the Key Vault for that account.
-
And the user can share their password, have it hacked, etc. Still not secure.
That is where MFA comes in. MS Authenticator or other. Differing levels of engagement there: -Are you trying to log in?, (yes that's me) - logging in, after userid and pwd validate, Authenticator chirps with yes or no -What number is on the screen, (42) - login shows a number, type it into the app -Which number is on the screen, (11, 34, 78) - login show a number, app shows choices, pick the right one -Enter the code on Authenticator app (010 767) - app gens a number, enter it into login dialog I am sure there are other options and there are other products. How you set it up - IDK - victim not perp. b
-
As per generally accepted usage, I put the key content on a yellow sticky note where my computer webcam can see it and route it up to the app. ;)