Skip to content

Comment on Amazon Is Downloading Apps From Google Play and Inspecting Themparent

Comments

Don't have the service store the secrets

Why not? You can use the service to make sure it doesn't leak its own secrets so it's safe ;-)

But seriously yes I really like your approach.

You could even provide a second set of API to do the opposite: given a block of text see if there's any sensitive string inside. Google & co could use it before publishing an app in their Store.

Either way you still have to trust another third party to keep your secrets safe. Even if the secrets weren't publicly leaked, any comrpomise to this service affects any service whose keys you have stored there.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.