Cease random applications from studying your Git and AWS credentials on Home windows – Code Evaluate

If you use Git or the AWS CLI, your tokens and keys usually sit in plain recordsdata, or in locations any program operating as you’ll be able to learn. You might not discover if one does.

Wardkey is a small, experimental instrument for Home windows. It retains your Git and AWS credentials in an encrypted vault. When Git or AWS asks for a key, Wardkey checks which program is asking and applies your guidelines earlier than giving something out.

Consider it like a doorman. Many instruments lock the door however give the important thing to anybody already inside. Wardkey checks each time: “Which program are you, and do your guidelines will let you have this key?”

• Shops credentials in an encrypted vault.
• Designed to work with Git over HTTPS (as a credential helper) and the AWS CLI (by credential_process).
• Applies guidelines about which app might get which credential.
• Can ask you for a Home windows Howdy verify (face, fingerprint or PIN) on every request, when your rule says so.
• Helps decoy keys. If something asks for one, the request is denied and logged.
• Writes choices to a neighborhood log that may detect many sorts of edits.

It’s written in Go.

That is an early prototype, and I’d fairly say so clearly:

• It doesn’t cease malware that’s already operating as you. A program operating as you would attempt to faux to be Git or AWS. Requiring Home windows Howdy on each request makes silent use tougher, since you see a immediate, however it isn’t a assure.
• No outdoors professional has reviewed it but.
• It’s Home windows-only.
• AWS help covers solely the official aws.exe, and Git help covers solely HTTPS.
• The exercise log can detect many edits, however not somebody deleting its final entries.
• Please check with dummy credentials solely.

The complete checklist is within the risk mannequin within the repo.

go construct -o wardkey.exe .cmdwardkey
wardkey assist

Setup particulars are within the README.

The place do you assume the design is weak, particularly the caller checks and the approval move? What would you need it to guard subsequent? Inform me within the feedback or through e-mail.