3

It's for a desktop app. I have an API key and secret but I don't know the most secure way to store and use them.

If my computer was lost or hacked for example, I want the keys and secret to be worthless but I assume this is not very easy to do.

9
  • 1
    lost or hacked are two different scenarios. Smartcard, perhaps.
    – zaitsman
    Mar 2, 2018 at 3:16
  • 2
    @zaitsman the OP never said they are the same scenario. Mar 2, 2018 at 3:24
  • 1
    @CodingYoshi There is no universal way to protect against both. Protecting against hackers using meltdown won't necessarily save you from the computer being stolen; and many of the techniques are mutually exclusive.
    – zaitsman
    Mar 2, 2018 at 4:06
  • Are the API keys/secret accessing some resource you control? If so, then "you" can invalidate any client by resetting it on the resource. If your computer was stolen or hacked you'll still need to "know" if/when such an event occurs...
    – EdSF
    Mar 2, 2018 at 4:53
  • 1
    there are many similar questions stackoverflow.com/questions/48840717/…
    – gusto2
    Mar 3, 2018 at 23:13

1 Answer 1

0

The best solution is to store your keys securely in Azure Keyvault https://azure.microsoft.com/en-us/services/key-vault/

That's exactly what its built for. Then the keys are never on your machine, so losing it doesn't matter.

2
  • 1
    How does this map to a desktop app?
    – EdSF
    Mar 2, 2018 at 5:59
  • 1
    It can't connect to the internet ? You didn't mention "offline capability" Mar 6, 2018 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.