← Back to context

Comment by MattIPv4

7 hours ago

Seen multiple folks in the Railway Discord confirming that their secrets stored in Railway have been used by third parties, so it definitely sounds like the attackers were able to read decrypted environment variables.

11 comments

MattIPv4

Reply
numbsafari  6 hours ago

Environment variables are a terrible place to store secrets.

I'm just going to say it, since having said it non-stop for over 20 years, nobody seems to listen and we keep circling this drain.

The 12 Factor manifesto was 100% wrong on this point.

Use environment variables to point to where secrets are located, not to store their values.

  • skinfaxi  5 hours ago

    > Use environment variables to point to where secrets are located, not to store their values.

    Now your apps need to be able to read the secret that is pointed to, as opposed to the task runner populating the secret and the app would not know about the details.Not to mention the changes it entails to development.

    • esseph  2 hours ago

      > Not to mention the changes it entails to development.

      Oh no, guess they'll have to hire developers that can adapt!

  • jrochkind1  5 hours ago

    It doesn't sound like they got them via a shell environment, they just hacked into the place that stored them. If the place you store secrets can be hacked into, it doesn't really matter if they are injected into environment variables or not.

  • trollbridge  2 hours ago

    Or we could just use our operating systems for the things we do well, and have a service to send our API calls to that inserts the appropriate token.

    I don't have to enter my Mac's password every time I open an app.

  • tptacek  6 hours ago

    Environment variables are generally fine for secrets. Environment files are problematic. Modern systems that inject secrets into the environment launch the program itself.

    • IanCal  5 hours ago

      (pre-caveat thing to not be massively annoyingly pedantic throughout, I'm not a security buff and I know who it is I'm talking to, I'm not trying to correct them)

      I'm not sure I get the difference - the issue I would have thought was having the system code have access to the secrets themselves? Env file vs env vars injected at runtime seems the same there - either can be exfiltrated. The difference would be having it injected when used.

      Is the problem with files about what happens outside that, being committed, etc?

      2 replies →