Key Management - Revision history

Tom: /* Full Title or Meme */

2023-09-06T05:00:15Z

‎Full Title or Meme

Tom: /* Problems */

2023-09-06T04:57:09Z

‎Problems

Tom: /* Problems */

2023-09-06T04:55:46Z

‎Problems

Tom: /* Reverences */

2023-09-06T04:54:35Z

‎Reverences

Tom: Created page with "==Full Title or Meme== ==Problems== * The Heartbleed bug shipped on March 14, 2012, it was not publicly discovered for two years. At its core, the issue was not the bug itsel..."

2023-07-11T18:11:40Z

Created page with "==Full Title or Meme== ==Problems== * The Heartbleed bug shipped on March 14, 2012, it was not publicly discovered for two years. At its core, the issue was not the bug itsel..."

New page

==Full Title or Meme==

==Problems==
* The Heartbleed bug shipped on March 14, 2012, it was not publicly discovered for two years. At its core, the issue was not the bug itself - as bugs are inevitable - but rather the design that left private keys in the user space of the application. 9 years later key management systems do this and worse today. They copy keys around in the clear, leaving them in environment variables and largely un-ACLed files stored in user space. Essentially, we are just one bug away from another Heartbleed-like exposure because the way we manage keys has not fundamentally changed.

==Reverences==

[[Category: Security]]

← Older revision		Revision as of 05:00, 6 September 2023
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
		+	Devices with keys in storage are lost, broken or upgraded. The user's want their data (and, in some cases, money) recovered. [[Key Management]] is the typical answer.

	==Problems==		==Problems==

← Older revision		Revision as of 04:57, 6 September 2023
Line 4:		Line 4:
	* The Heartbleed bug shipped on March 14, 2012, it was not publicly discovered for two years. At its core, the issue was not the bug itself - as bugs are inevitable - but rather the design that left private keys in the user space of the application. 9 years later key management systems do this and worse today. They copy keys around in the clear, leaving them in environment variables and largely un-ACLed files stored in user space. Essentially, we are just one bug away from another Heartbleed-like exposure because the way we manage keys has not fundamentally changed.		* The Heartbleed bug shipped on March 14, 2012, it was not publicly discovered for two years. At its core, the issue was not the bug itself - as bugs are inevitable - but rather the design that left private keys in the user space of the application. 9 years later key management systems do this and worse today. They copy keys around in the clear, leaving them in environment variables and largely un-ACLed files stored in user space. Essentially, we are just one bug away from another Heartbleed-like exposure because the way we manage keys has not fundamentally changed.

−	~~==Problems==~~
	* Most [[Key Management]] schemes involve storage of some recovery mechanism in the cloud. That's similar to what Last Pass did for [[Cryptocurrency]] wallets. As should be expected, they were hacked.<ref>Brian Krebs, ''Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach'' (2023-09-05) https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/ </ref> "A breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults."		* Most [[Key Management]] schemes involve storage of some recovery mechanism in the cloud. That's similar to what Last Pass did for [[Cryptocurrency]] wallets. As should be expected, they were hacked.<ref>Brian Krebs, ''Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach'' (2023-09-05) https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/ </ref> "A breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults."

@@ Line 5: / Line 5: @@
 ==Problems==
-* Most [[Key Management]] schemes involve storage of some recovery mechanism in the cloud. That's similar to what Last Pass did for [[Cryptocurrency]] wallets. As should be expected, they were hacked.<ref>Brian Krebs, ''Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach'' (2023-09-05) https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/ </ref>
+* Most [[Key Management]] schemes involve storage of some recovery mechanism in the cloud. That's similar to what Last Pass did for [[Cryptocurrency]] wallets. As should be expected, they were hacked.<ref>Brian Krebs, ''Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach'' (2023-09-05) https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/ </ref> "A breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults."
 ==Reverences==
 [[Category: Security]]