Stage 1: "Things are simple, our only secret is this AWS key, we don't need a secret manager."

Stage 2: "For consistency, we'll handle our second and third secrets just like that first secret. Or handle them through our existing configuration management system, with just some minor tweaks."

Stage 3: "If we mess up the credentials for these edge devices, the software update, monitoring and remote management features will break and we'll have to recall the devices. We should be very cautious about making any changes."

Stage 4: "Even with a secret manager, we'd have to protect the credential used to access the secret manager. Not to mention a long-lived credential to bootstrap new devices, or re-image broken devices in the field. The real solution here is Secure Boot and credentials tied into the TPM. If we want to do this, we'll need a team of six full-time developers and our own custom linux distro"

Stage 5: "End-user features and business value are our priority right now, credential rotation is on the schedule for Q3 next year"

This is not even a secrets manager problem. Those have their place but it’s a different link in the chain, or I guess layer in the onion.

The answer to this type of thing is full disk encryption (FDE). There’s zero reason not to have it on every device at the block level. Especially if you’re going to be processing highly sensitive data.

You can’t even trust disks to actually delete things anyway. So the only way to be sure that information is not leaked is to prevent it from ever being persisted to disk in plaintext.

Lack of senior infra engineer-itis. It's fairly normal not to realise there are entire ecosystems of tools and conventions to solve certain problems if you haven't come across them many times before.

I have a question about that, for my personal accounts I have created a simple php file that I store locally where I can input one password that I know. Then it gets hashed with a salt + salt based on the website that I use this password at.

This hash of 24 chars is my password for that account. I don't trust any of the online password managers. Is this actually safe or not?

Note: this is not used for any of my professional work

“Ah I can just roll my own in half an hour!” Says the person with a learning curve ahead of them!

"We've got $10M VC money and I've always wanted to try writing a secrets manager"

Resümee driven engineering?