Hacker News Reader

if the provider gets popped doesn't the binary get popped too? then simply use an LLM to reverse engineer the binary and get the key?

View on HN

If its a targeted attack, they'll know and probably "crack" it. If its just data trawling, you might get owned one day if they bother, but likely the env `AWS_KEY=encrypted_abc` looks reasonably close to `AWS_KEY=unencrypted_abc` and any API key probing will just look like it got rotated already.

I think siblings are correct that the more widespread this is, the less effective once every dump is run through a "also look for keys in the binary" step.

If you want to be really paranoid you can make it an online process: application server makes an HTTPS request to a key server on different infrastructure to get the decryption key, then decrypts the secret. Use an IP whitelist.

That way read access to your infra provider is not sufficient, it requires an active component.

Reply on news.ycombinator.com