Can you keep a secret?

2017-07-26

by Andrie de Vries

For quite some time I wished a package existed that would allow me to encrypt passwords so I would not have to worry about accicentally leaking secrets. Gábor Csárdi and I co-authored the secret package, to encrypt passwords and other secrets you want to share. The package enables secure sharing of sensitive information in R packages.

I became involved in this project because I wanted to find a way to test the AzureML package. AzureML is an interface between R and the Microsoft Azure Machine Learning Studio (Azure ML). To use these tools, you have to log in to Azure using your workspace credentials. So, to test the package, the test suite also has to log in. I used to do this by creating a local file (outside the package folder) with my credentials.

This worked fine as long as I worked by myself. However, this made it difficult to collaborate with other peopl on the project, since they would have to replicate a test environment and create their own credentials file.

The code

You can find the package source code at github and install it directly from CRAN

install.packages("secret")

Introducing the package at UseR!2017

We introduced the secret package at UseR!2017, and published this on CRAN only a few weeks earlier, on June 17th.

The talk was very well received. David Smith blogged about it during the conference…

Don't put API keys or other secure data in R scripts or packages. Use the "secret" package instead — @RevoAndrie at #user2017 #rstats pic.twitter.com/3NqoPY9qyA
— David Smith (@revodavid) July 6, 2017

… and then wrote a very nice blog post at Revolutions:

To securely store API keys or passwords in R scripts, use the "secret" package by @GaborCsardi @RevoAndrie https://t.co/246RJgzPzm #rstats
— David Smith (@revodavid) July 18, 2017

Watch the video

The entire event, including this presentation, was recorded by Microsoft. You can watch the video at Channel 9:

And the presentation

Here is the presentation:

The demo

During the talk I gave a demo, loosely based on the package vignette: