If there is no choice than exposing private keys that needs to be rotated in case of compromise then perhaps that is an incompetent design choice, isn't it? Co-locating services where available or limit from what location a key is accepted, why that is not an option? I still think that if there is 'no other choice than exposing secrets' then there is some seriously fundamental wrongdoing is involved there and there is no-one else to blame for the lots of fuck ups happening than those forming those services - who else, basically, right? the weather or some imaginary father-figure? - the way they do. Regardless if this is a widespread practice. Many wrong will not make something good. There is always a choice, like not doing what cannot be done right. Right?
We reached a state where whatever is on the web that cannot be trusted. Users worry, privacy and secrets are compromised on a huuuge scale, while the creators who did this way are saying 'this is normal business'. That's not right! Privacy is sacrificed for developer's convenience.
We reached a state where whatever is on the web that cannot be trusted. Users worry, privacy and secrets are compromised on a huuuge scale, while the creators who did this way are saying 'this is normal business'. That's not right! Privacy is sacrificed for developer's convenience.