Challenge 44 ☆☆☆☆

Welcome to challenge Challenge 44. You need to guess the secret that is hidden in Java, Docker, Kubernetes, Vault, AWS or GCP.

Vault Metadata Challenge

Secrets management systems now often have metadata support for their secrets! This is awesome, as it allows you to enrich the secret with contextual data further, making it easier to remember the secret.

But what if you put confidential/secret information into a secret by mistake?

A developer has put secret metadata on a wrongsecret in Vault. Can you find it?

Tip: take a look at the policies when vault is installed; you can see that the application is only allowed to use the metadata ;-).

Answer to solution :

Why putting sensitive data as metadata is a bad idea

Sometimes, people reason that less sensitive data should be stored as secret metadata. Think of, for instance, a username - less sensitive than a password, or is it? In many of these cases, these are equally important and should get equal protection as the secret (e.g. the password) itself.

We often don’t want to give read access to secrets to our employees, but we do want to give read access to metadata instead. If any secret is stored in the metadata, that secret is then compromised internally.


Previous
Go the main page
Next
0