password redaction strategy

[e2o]

Hello!

So, I use BBEdit to write detailed client notes for my IT consulting clients. My company came up with a new format in which we have to keep notes, and in this "improved" standard, passwords cannot be stored in the documentation. (The idea is that rather than passwords, links to items in a secure SecretServer (Thycotic software) will be in the documentation.)

Anyway, I'll be forced to keep my notes in this central repository current, but there is no way I can efficiently work from a remote repository with passwords separate from other content. So I'll have to remove passwords from my text documents regularly, and copy the redacted notes to the central store. I know there is probably dozens of clever ways to tag the passwords and remove them in one simple multi-file replace, but if anyone has a nice workflow they have created to do something similar, I'd love to hear it before cobbling together some hack.

Thanks!

- eric

[Darren Duncan]

Eric,

The way it comes across is you have some system that fakes actual passwords
being in documentation files without them actually being there, and this sounds
incredibly complicated and error-prone.

What would be a LOT better is to never even pretend or fake having passwords
where they shouldn't be, never put them in your documentation even temporarily.

Instead, have a system of named variables or entities where all your actual
documents simply indicate the name of a password, an identifier that itself is
not secret nor needs to be changed.

Then when someone is reading a document that talks about secrets, rather than
seeing the secret/password itself, they see the non-secret name, and then they
take that name and provide that to the secret server to get the actual password.

The secret names should be descriptive enough that people have an idea what they
are and if the secret server has a list of name-value pairs one can maintain
those easily enough independently.

So never put your passwords in your non-secret files to begin with.

-- Darren Duncan

[e2o]

On Friday, April 10, 2020 at 8:01:09 PM UTC-7, Darren Duncan wrote:

So never put your passwords in your non-secret files to begin with.

Well, this is the whole point. My notes pre-date the larger organization that now wants to standardize notes being separated from passwords. BUT, by workflow is built around a streamlined single-document model around which I have all kinds of productivity workflows built. I'm trying to accomodate the new order while preserving my workflow. 

I'm settling on tagging passwords in the document, doing a search-and-replace to remove them prior to exporting to the common notes collection. The passwords will be replace with some kind of indicator that the password can be found in the official vault.