AWS KMS for most thing.
AWS ACM for SSL certs.
AWS SSM for ssh, eliminates the needs for ssh keys.
Not everyone loves AWS (me included), but this stack works nicely in removing the need to ever touch raw encryption key files locally.
Ask HN: How does your company manage its encryption keys?
11–20 of 246 posts
Re: Ask HN: How does your company manage its encryption keys?
#12Vault for big stuff, git-crypt for file-level encryption of secrets (in Terraform files etc.)
Re: Ask HN: How does your company manage its encryption keys?
#13[deleted]
Re: Ask HN: How does your company manage its encryption keys?
#14Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.
Re: Ask HN: How does your company manage its encryption keys?
#15> How does your company manage its encryption keys?
Poorly seems to be the answer industry wide. Both encryption and disaster recovery are hard tasks. Combine them and you have recipe for a total mess.
Re: Ask HN: How does your company manage its encryption keys?
#16https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…
Especially convenient with KMS auto-unsealing (https://learn.hashicorp.com/vault/operations/ops-autounseal-...)
Re: Ask HN: How does your company manage its encryption keys?
#17https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…
Looks cool, one small nitpick is regarding their cookies banner. You can click "preferences" and it says "To opt out of a category of data collection, set the toggle to “Off” and save your preferences".
Not only it is opt-out, but the mentioned "off" toggle doesn't even exist.
Re: Ask HN: How does your company manage its encryption keys?
#18https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…
Looks cool, one small nitpick is regarding their cookies banner. You can click "preferences" and it says "To opt out of a category of data collection, set the toggle to “Off” and save your preferences". Not only it is opt-out, but the mentioned "off" toggle doesn't even exist.
They also have a link to their Privacy policy, which is a 404: https://www.vaultproject.io/privacy
Re: Ask HN: How does your company manage its encryption keys?
#19https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…
Looks cool, one small nitpick is regarding their cookies banner. You can click "preferences" and it says "To opt out of a category of data collection, set the toggle to “Off” and save your preferences". Not only it is opt-out, but the mentioned "off" toggle doesn't even exist.
A bit weird to have a company working with such sensitive data not care about privacy.
Re: Ask HN: How does your company manage its encryption keys?
#20Nice try, NSA.