The Secret Life of Secrets
summary
A comparison of key designs shows concrete risks and fixes: webhook URLs leak far more because they look like regular links and end up in logs; researchers scrape public sites and find webhooks as the most common exposed SaaS secret. Cracking experiments recover weak JWT symmetric secrets for about 2% of tokens offline, and over 11,000 GitHub SSH keys are factorable or reused. Recommendations: generate keys server-side, use fixed prefixes for discovery, avoid unnecessary JWTs, and prefer 20+ random characters.
AI-written summary · about
chapters (12)
- 0:00The impact of design on UX
- 4:26API security and design
- 6:06The form factor of secrets
- 8:32Case study: The web hook
- 9:10Consequences of URL design
- 13:12The legacy of bad patterns
- 13:48Web hook security risks
- 14:02Defining web hook risks
- 14:12Questioning design standards
- 14:42Cryptographic pitfalls
- 30:56Security best practices
- 31:38Summary and recommendations
related talks
26mHow To Keep A Secret
47mThe Hacker's Guide to JWT Security
29mBe nice, help the person who hacks your servers to get your data
31mThe Hacker's Guide to JWT Security
48mThe Hacker's Guide to JWT Security
24mHow to Find if Your Developers are Leaking Secrets?
45mWrongSecrets: We Have a Secret for Everyone!
39mSecrets Management: How to (not) help the person who hacks your servers get your data