Show HN: Laptop is the last place your secrets are still in plaintext

Jitpass presents jit, a new macOS tool addressing the pervasive problem of plaintext secrets scattered across developer machines. It encrypts credentials in a Touch ID-gated vault, injecting them just-in-time for specific processes, thereby protecting against rogue scripts and AI agents. Hacker News is dissecting its security model, installation practices, and the inevitable 'but what about Linux?' query.

Score

Comments

Highest Rank

on Front Page

First Seen

Aug 16, 7:00 AM

Last Seen

Aug 16, 7:00 AM

The Lowdown

Jitpass introduces jit, a macOS-only tool designed to safeguard developer secrets by moving them from plaintext files into an encrypted, Touch ID-protected vault. It aims to prevent unauthorized access by processes or malicious scripts, including those run by modern AI agents, by injecting credentials into memory only when explicitly requested and approved.

Secret Relocation: jit scans for secrets in common locations (e.g., .env, ~/.aws/credentials, shell configs) and securely migrates them to a local, encrypted vault. Original files are replaced with non-sensitive decoys or hooks that resolve the real value from the vault.
Just-In-Time Injection: Credentials are not left in plaintext; instead, they are injected into a process's memory only at the moment they are needed, after biometric authentication via Touch ID.
Two-Factor Touch ID Gating: The tool employs a two-stage Touch ID system: one to unlock the vault for a session (e.g., 5 minutes) and another to approve a specific tool's request for a credential, ensuring fine-grained control even with an open vault.
Migration and Wrapping: Users can jit migrate to secure existing credentials in files, or jit wrap specific CLIs (like gh, stripe) to have jit manage their tokens seamlessly, often without changing how commands are run.
Process Grants: For unattended operations (e.g., CI, AI agents, long builds), jit allows pre-approving specific processes to access secrets for a bounded duration, bypassing interactive prompts.
Audit Trail: All jit actions, including commands, vault unlocks, and denied requests, are logged in a durable, filterable audit trail for transparency and security monitoring.
Reversibility: jit never destroys original credentials; it backs up modified files and offers an undo command to revert any changes, ensuring data integrity.
Broad Support: Supports a wide array of common developer tools and configurations, including AWS, GCP, Docker, shell exports, .npmrc, and various CLI tokens.

By leveraging Apple's Secure Enclave and Touch ID, jit offers a novel approach to securing developer workstations against the risks of widely accessible plaintext secrets, while striving to maintain a smooth, familiar developer workflow.

The Gossip

Security Scrutiny & Skepticism

Commenters raise fundamental questions about `jit`'s security model. They challenge the premise that most secrets are in 'plaintext,' pointing to existing protections like passphrase-protected SSH keys and full disk encryption. Concerns are voiced regarding trust in `jit`'s crypto implementation, protection against in-memory plaintext exposure, and whether containerization offers a more robust solution for managing untrusted software.

Installation Intrigue & `curl | sh` Concerns

A significant point of discussion revolves around `jit`'s `curl | tar` installation method. While some commenters clarify that it's not the infamous `curl | sh` (piping to a shell), many highlight the irony of a security tool suggesting direct download and execution from a URL, especially when the README itself warns against 'bad `curl | sh`'. The debate touches on trust in package managers versus direct binary downloads for critical security tools.

UX & Platform Praise (and Pleas)

Despite security debates, several users express appreciation for `jit`'s intuitive user experience and its innovative features, such as the `scan` and `process grant` functionalities. However, a recurring sentiment is the tool's macOS-only nature, with many commenters expressing strong interest and making pleas for Linux or other platform support.

How It Works Wonders

A few comments delve into the underlying technical implementation of `jit`, curious about how it achieves its just-in-time injection and process-specific access. In response, the author or other users point to the provided documentation, detailing the mechanics of file system drivers, credential helpers, and shims used to deliver secrets.