Ask HN: How do you handle sensitive information (passwords, SSH keys, etc.)?

#1

Post by miGlanz » Wed, Feb 09, 2011, 9:13 AM UTC

I'd like to get some ideas of proper procedures for handling sensitive information of your company. Something like: how do you store your SSH keys, who can access those and how, how are they backed up, where are they stored?

Basically I'd like to prepare detailed procedure (checklist?) that would lower the possibility of losing this kind of important data.

Re: Ask HN: How do you handle sensitive information (passwords, SSH keys, etc.)?

#2

Post by nyellin » Wed, Feb 09, 2011, 9:41 AM UTC

I'm working on a two-man project.

1. All sensitive information is encrypted.

2. SSH keys are password protected.

3. I store passwords in LastPass, with a unique master password.

4. SSH keys are stored on my own computer and backed up with Dropbox.

Point #4 is obviously the weakest link, so I am looking to change that. However, so far, Dropbox's ubiquity justifies it. When my laptop died, I was able to download setup a new development machine in minutes.

Re: Ask HN: How do you handle sensitive information (passwords, SSH keys, etc.)?

#3

Post by JoachimSchipper » Wed, Feb 09, 2011, 11:00 AM UTC

Passphrase-protected SSH keys on an encrypted disk. The latter is key - it makes mistakes so much less likely.

Re: Ask HN: How do you handle sensitive information (passwords, SSH keys, etc.)?

#4

Post by ewan » Wed, Feb 09, 2011, 12:10 PM UTC

http://www.cyber-ark.com/digital-vault-products/enterprise-p... is something I've worked with, though I've never seen what I would consider a well integrated deployment

Re: Ask HN: How do you handle sensitive information (passwords, SSH keys, etc.)?

#5

Post by marklabedz » Wed, Feb 09, 2011, 2:11 PM UTC

For passwords and other sensitive, text-type, info: KeePass in Dropbox for syncing http://keepass.info/

For SSH keys, tax returns, other sensitive documents: True Crypt volume http://www.truecrypt.org/