Comment by echoangle
3 days ago
> Fundamentally, if you're giving an application your passwords, it is precisely so that the application can transmit those passwords, in full, to the relevant services.
This is about secrets in general. Those could just as well be used to encrypt local data or sign session cookies for the internal web page. And sending the secret to the service it is for is different than sending it (or at least a part of its hash) to another service the user might not trust.
Sorry, can you provide a link to where the HA application is scanning the filesystem for secrets in general? I thought this was just the passwords you hand over so it can automate things
I agree that it only applies to HA secrets but HA also has a web interface. Secret doesn’t mean only password