If you run on kubernetes it has first class support for secrets [0]. You can reference secrets in environment variables, or mount them as files in your containers.
[0] https://kubernetes.io/docs/concepts/configuration/secret/
Ask HN: How does your company manage its encryption keys?
111–120 of 246 posts
Re: Ask HN: How does your company manage its encryption keys?
#112Earlier quoted context omitted.
We have very simmiliar issue. All our databases have password Qwerty1234 Android keystore is checked in repository with access key in scripts. Security keys for external services are also checked in into repository. Some external services for production are managed by devs that are long time ago not working in our company
Hehe. Less than 8 years ago I asked for help to add a column in a database at a company I helped. This was a few days after they met me for the first time. The company solved this by giving me a root username and password that worked on every single important database in the company, at least every customer database. I had to beg them to create a somewhat restricted account. The same company was however deeply scepti…
On one my past job there were fingerprint reader system on enter to office. Almost 6 years later, I were still able to enter office with my fingerprint.
Re: Ask HN: How does your company manage its encryption keys?
#113We use Knox: http://github.com/pinterest/knox
Think of a lighter vault, with ACLs for people and/or machines to access keys and versioning to rotate keys.
In our case, Knox depends upon AWS KMS to "lock/unlock" its storage.
Re: Ask HN: How does your company manage its encryption keys?
#114https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…
This just pushed the problem further down the stack. You should have keys to unlock vault when it is restarted. How do you secure those keys?
I can't seem to understand how a "secrets manager" helps things. Could someone who does ELI5 why it's better than a config file with permissions locked down?
Re: Ask HN: How does your company manage its encryption keys?
#115Honeypot post, don't get doxxed
Lol, I guess this should be the first answer of the thread.
But also, at that point you're fully committed to security through obscurity, so folks should get at least the obscurity part right :)
Re: Ask HN: How does your company manage its encryption keys?
#116https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…
This just pushed the problem further down the stack. You should have keys to unlock vault when it is restarted. How do you secure those keys?
If you use Vault, you should use it as an RBAC system as well.
That means that each application got a ServiceAccount (SA) and each user got a username/password. Based on your identity, you get access to specific secrets from Vault.
Re: Ask HN: How does your company manage its encryption keys?
#117I am curious how you managed to restore it if you lost the keys.
"accidental" backups
Re: Ask HN: How does your company manage its encryption keys?
#118https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…
This just pushed the problem further down the stack. You should have keys to unlock vault when it is restarted. How do you secure those keys?
Store them in a separate instance of Vault.
Re: Ask HN: How does your company manage its encryption keys?
#119Earlier quoted context omitted.
This just pushed the problem further down the stack. You should have keys to unlock vault when it is restarted. How do you secure those keys?
I can't seem to understand how a "secrets manager" helps things. Could someone who does ELI5 why it's better than a config file with permissions locked down?
It makes sense at scale. If you are a company of two there are probably better solutions.
At scale, you can very granularly define policies for each secret. When a secret is accessed, it is done so through a user or application identity. Each access is also logged.
Re: Ask HN: How does your company manage its encryption keys?
#120https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…
+1 for Vault, where I work we are in the process of switching to it.
Automatic password rotation for AD credentials[1] is especially useful to us.
Meanwhile we use the project level variables Gitlab API[2]
Secrets are kept in Gitlab and requested by applications through a token that can easily be revoked
[1] https://www.vaultproject.io/docs/secrets/ad#password-rotatio...
[2] https://docs.gitlab.com/ee/api/project_level_variables.html