How To Keep A Secret
summary
Practical rules and concrete failures: docs that paste API keys into code lead to immediate compromise — automated scrapers grab leaked keys minutes after commit — so use a password manager (1Password or browser built‑in), enable full‑disk encryption and encrypted backups, load secrets with the keyring module, protect high‑value keys with hardware WebAuthn tokens and the custom token ring backend (demonstrably prompts for touch), shorten scopes and lifetimes with tools like gimme-aws-creds or aws‑vault and use HVAC/HashiCorp Vault for cloud secrets.
AI-written summary · about
chapters (11)
- 0:00Introduction to secrets
- 2:24The dangers of mismanagement
- 5:05Password security basics
- 8:07Avoiding phishing attacks
- 10:08Secure coding practices
- 13:18Alternative storage solutions
- 15:43Using the keyring module
- 17:26Advanced threats and protections
- 20:27Creating custom backends
- 22:18Comprehensive security strategy
- 24:05Beyond local storage
related talks
29mBehind Closed Doors: Managing Passwords in a Dangerous World
30mBehind Closed Doors: Managing Passwords in a Dangerous World
38mKeeping Secrets - A Practical Approach to Managing Credentials
29mBe nice, help the person who hacks your servers to get your data
46mSecrets Management for the Modern Tech. Pro
34mThe Secret Life of Secrets
26mSecret Hunting
27mCan you keep a secret?