Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.
Sounds very convenient to use.
Ask HN: How does your company manage its encryption keys?
191–200 of 246 posts
Re: Ask HN: How does your company manage its encryption keys?
#192Earlier quoted context omitted.
This is all generally good advice, but I think there's huge potential complexity lurking here: > 4. Take care of the physical keys with proper storage and procedures. Do not store the keys together, have at least one in a really secure location, check if you have all the keys regularly, etc. Would be great to see what folks think this concretely looks like for joe random startup in Capital City, Somewhere. e.g. Does…
> Does "really secure" mean "find a bank that still offers safety deposit boxes"? Realistically? Yes. This is what several of the companies I've done contract work for have done. You can still find at least one bank or self-storage place (look for the ones that don't have a nationally-advertised brand and don't look like they're made entirely out of corrugated metal) that do regular safety deposit boxes in pretty muc…
One problem with a safe deposit box is what happens if things go to hell at 2am? The bank isn't going to open for another 6 or 7 hours, and meanwhile you're sitting there with possibly business-destroying downtime.
Re: Ask HN: How does your company manage its encryption keys?
#193Earlier quoted context omitted.
Hehe. Less than 8 years ago I asked for help to add a column in a database at a company I helped. This was a few days after they met me for the first time. The company solved this by giving me a root username and password that worked on every single important database in the company, at least every customer database. I had to beg them to create a somewhat restricted account. The same company was however deeply scepti…
With root access I suppose you could have created a restricted account yourself!
I end up doing something like that whenever I’m granted root. I create a limited account, then delete the root or, if it’s shared, ask that the password be changed.
Re: Ask HN: How does your company manage its encryption keys?
#194Plugging my project Certera as a means to manage keys used for Let's Encrypt certificates: https://docs.certera.io
You can rotate keys and facilitate key pinning scenarios.
Cheers!
Re: Ask HN: How does your company manage its encryption keys?
#195We have a shared Dropbox account with 2fa hardware and no otp
Re: Ask HN: How does your company manage its encryption keys?
#196Notepad
Re: Ask HN: How does your company manage its encryption keys?
#197Earlier quoted context omitted.
We have very simmiliar issue. All our databases have password Qwerty1234 Android keystore is checked in repository with access key in scripts. Security keys for external services are also checked in into repository. Some external services for production are managed by devs that are long time ago not working in our company
Hehe. Less than 8 years ago I asked for help to add a column in a database at a company I helped. This was a few days after they met me for the first time. The company solved this by giving me a root username and password that worked on every single important database in the company, at least every customer database. I had to beg them to create a somewhat restricted account. The same company was however deeply scepti…
At a previous job they refused to give me database access and instead insisted I ask them whenever I needed any columns added/altered, however I did have access to the code to do my job and...mysql root credentials were committed to the repo.
To keep the charade up I sent one of every 20 requests to them to do for me.
Re: Ask HN: How does your company manage its encryption keys?
#198Related question: How do big companies (FAANG) store their root private key?
Re: Ask HN: How does your company manage its encryption keys?
#199Earlier quoted context omitted.
This is all generally good advice, but I think there's huge potential complexity lurking here: > 4. Take care of the physical keys with proper storage and procedures. Do not store the keys together, have at least one in a really secure location, check if you have all the keys regularly, etc. Would be great to see what folks think this concretely looks like for joe random startup in Capital City, Somewhere. e.g. Does…
> Does "really secure" mean "find a bank that still offers safety deposit boxes"? Realistically? Yes. This is what several of the companies I've done contract work for have done. You can still find at least one bank or self-storage place (look for the ones that don't have a nationally-advertised brand and don't look like they're made entirely out of corrugated metal) that do regular safety deposit boxes in pretty muc…
> stick it under your bathroom sink with the cable wrapped firmly around the water supply or drain pipe
What's the idea behind this? So that when someone tries to break in, they flood your bathroom? Or do you just mean secure it reasonably?
Re: Ask HN: How does your company manage its encryption keys?
#200Earlier quoted context omitted.
If this is a public repo then you are already hacked. There are multiple automated systems that scan public repos for credentials. 5 minutes later you are mining bitcoins for them.
In a boneheaded movei I accidentally committed my SendGrid creds to GitHub. Pretty quickly after, GitHub alerted me. However by then my SG account was sending thousands of automated spam messages. Those automated scammer systems are FAST. Not particularly germane to the discussion, but really disappointed in how SendGrid handled things. I notified them immediately, rotated all API tokens, and tey could not turn it of…
So this has happened at more than one company that I've been at, only difference is that these were AWS keys and used to mine bitcoin. AWS was actually pretty good about it, we rotated the keys as quickly as we could and they dropped all the charges.