20180907 Chain of secrecy
September 7, 2018•158 words
You know how you can unravel an entire crocheted hat by pulling on a single piece of yarn?
That's how I feel engaging with the chain of secrecy for automated interfaces. Somehow I'm supposed to keep secret #1 a complete secret until client program needs it to open a local vault to fetch another secret to ask the main vault for a token, used to open that vault to get two more secrets, which are needed to fetch another secret and token from authorization interface, so it can finally(!) open the data interface.
Just pull on the thread of first secret and watch it all go poof.
Yes, I know the layers limit access scope, allow instant revocation, blah blah, and that's all well and good. But no matter how many nested locked boxes, the very first key can only be protected by hiding, not by another lock. So… it's not actually secure.
And my head is cold.