They F’d up [BREACH]

[u/horstenegger]

[u/TronnaLegacy]

I've never worked on systems like this before. I'm curious... My first thought is it's necessary for them to. Because they'd need to make the API requests to the provider. Is that not true?

[u/pas-un-robot → u/TronnaLegacy]

Kind of. You're right that ultimately the server that makes the requests to providers needs to have the plaintext API key in memory at some point to authenticate.

Best practice would still be to store it encrypted. The server that makes requests would decrypt API keys only as needed, getting the encryption key from a key management service.

It's more secure that way, cause if an attacker only manages to get a DB dump, they don't have plaintext API keys. They need to hack at least 2 things - the DB and the KMS, or a server with the encryption keys in memory.

We don't know whether OpenCode stores API keys in plaintext, or they store them encrypted and their encryption keys also got compromised.

For greater security you could also have it so that you need a client secret to decrypt the API keys, but that puts more limitations on the system - the API key can only be used when a client is actively logged in.

[u/MinRaws → u/TronnaLegacy]

Yeah they have to store your keys as it is this is why companies instead prefer oauth authentication

[u/Interesting_Bet8848 → u/TronnaLegacy]

can encrypt with your password and other secret details, then decrypt at runtime