Not read the thread - will do next week (traveling atm)<div><br></div><div>But one thing I noticed<br><br>On Wednesday, April 16, 2014, Bruno Oliveira <<a href="mailto:bruno@abstractj.org">bruno@abstractj.org</a>> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Ahoy, answers inline<br><br>
<br>
> And second question, I know Security is not often a good mate with UX but ,<br>
> the console will never show the master/variant secret anymore ?<br>
<br>
Also correct. There is nothing set in stone, is just a proposal, because<br>
atm anyone with read access do the database could impersonate push<br>
applications. </blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"></blockquote><div><br></div><div>I think we would need to continue having IDs/secrets visible on the UI</div>
<div><br></div><div>IMO It's very hard to use Push server, w/o that information; again I didnt read the entire thread yet</div><div><br></div><div>Perhsps, we could hide the key (***************) for read-only users; but I think the overall concern is having them in the DB. My guess is that we need to have them being stored on the DB</div>
<div><br></div><div>-Matthias<span></span></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Another alternative would be to have a single key to the<br>
whole database and only derive the IV, but that would defeat the purpose.<br>
<br>
In addition I discussed the possibility of make use of vaults from<br>
Wildfly, but it's not ready yet<br>
(<a href="http://lists.jboss.org/pipermail/security-dev/2014-April/001557.html" target="_blank">http://lists.jboss.org/pipermail/security-dev/2014-April/001557.html</a>).<br>
Is only available for datasources. That's why I would like to hear about<br>
the impact of this change and why the master secret/secret must be<br>
persisted.<br>
<br>
--<br>
abstractj<br>
<br>
<br>
</blockquote></div><br><br>-- <br>Sent from Gmail Mobile<br>