Depending on what the keys are for, we use either 1Password or EnvKey for storing them.
Ask HN: How does your company manage its encryption keys?
21–30 of 246 posts
Re: Ask HN: How does your company manage its encryption keys?
#22Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.
If those are the keys used in production, then I'm horrified.
If they're dev-keys, I think this is pretty common.
Re: Ask HN: How does your company manage its encryption keys?
#23At one job I was afraid of losing a set of keys, so as an extra backup, we had a physical copy of the the key printed out as a QR code. This was then physically locked away (safe deposit or similar). But I like this as an option for a “failure resistant” offline backup. The main benefit is that doesn’t assume a stored away USB stick will still be readable while still having a somewhat machine readable format. Yes, the QR code was very large, but could be split into multiple files if needed.
Re: Ask HN: How does your company manage its encryption keys?
#24I put them into a password manager which is backed up both on Dropbox as part of sync and Backblaze for long term.
Re: Ask HN: How does your company manage its encryption keys?
#25Earlier quoted context omitted.
Looks cool, one small nitpick is regarding their cookies banner. You can click "preferences" and it says "To opt out of a category of data collection, set the toggle to “Off” and save your preferences". Not only it is opt-out, but the mentioned "off" toggle doesn't even exist.
They also have a link to their Privacy policy, which is a 404: https://www.vaultproject.io/privacy
I bet it's because it's a relative link. I don't get the cookie banner because I'm from canada but the links at the bottom redirect to Hashicorp.
The privacy policy is here: https://www.hashicorp.com/privacy
Re: Ask HN: How does your company manage its encryption keys?
#26Vault for big stuff, git-crypt for file-level encryption of secrets (in Terraform files etc.)
What happens if vault gets destroyed or corrupted?
Re: Ask HN: How does your company manage its encryption keys?
#27We use StackExchange's blackbox to check in GPG encrypted secrets into our monorepo: https://github.com/StackExchange/blackbox
Re: Ask HN: How does your company manage its encryption keys?
#28At a prior company they were printed off and stored in a typical file folder.
Re: Ask HN: How does your company manage its encryption keys?
#29YubiHSM 2 has worked fantastically well for us as a root of trust in a variety of applications, at a very reasonable price ($650) (I am unaffiliated with Yubico other than as a very satisfied customer).
Accessible over USB or HTTP, it supports every major crypto algorithm [1], and keys can be backed up onto another HSM via a wrap key (if they are marked as exportable -- you can also control what can and cannot be exported -- in fact, every operation may be allowed or disallowed per key).
Every operation is logged for audit, of course, and the device may be setup to require logs to be read before they are overwritten. In combination with configuring a special authentication key to access the logs, you can ensure that every operation on the HSM is logged to a remote store before additional operations may be completed.
It does depend on your existing physical security, so that has to be taken into account when designing architectures including it. The micro form factor at least makes it trivial to put into an internal USB port.
And of course, if you require a more enterprise grade tool, you may want to use an HSM in combination with a tool like Hashicorp Vault to manage your keys throughout your orgnaization.
[1] https://developers.yubico.com/YubiHSM2/Product_Overview/
Re: Ask HN: How does your company manage its encryption keys?
#30We use Azure KeyVault