Lead Image © Sergey Nivens, 123RF.com

Efficient password management in distributed teams

Secure Transfer

Article from ADMIN 43/2018

By Jakob Holderbaum

Team members often need certain information to authenticate against servers. You don't want to save this secret data in plain text, but you don't want to retype it every time, either. How can you share these secrets?

Consider the simple case of a web application database that requires authentication. The challenge is to share this secret information in an efficient but secure way and to transmit it automatically at a later date. What is the best way to do this?

Three Approaches

Traditionally, you have several ways to manage secrets associated with an application. The oldest method is probably the use of constants in source code, such as:

var PASSWORD = 'sn4k3oil'

This method tackles the challenge of keeping secret information synchronized between all team members in a simple, although not secure, way.

On the one hand, anyone who has access to the source code is automatically in possession of the secret information – regardless of whether it is necessary or desirable. On the other hand, exchanging keys with this procedure can turn out to be a tedious process, because the source code has to be changed, checked in to a version management system, and redistributed each time. It also makes it difficult to use the same code in multiple environments, such as a development environment and a production environment.

These disadvantages need to be avoided in a more mature alternative by storing secrets in configuration files that are not checked into version control. If you use this approach, you can remove the constants from the source code, but you accept other disadvantages. Without version control, synchronization between team members that was previously feasible is no longer possible. If a team member wants to change their password, they need to inform everyone else about it and find a secure way to do so. Additionally, this procedure results in unencrypted files on clients and servers that users can forget.

Subsequently, a third method has been established to keep secret information away from both the local filesystem and the source code. This method uses

...

Use Express-Checkout link below to read the full article (PDF).