Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How does your company manage its encryption keys?

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 246 posts

Re: Ask HN: How does your company manage its encryption keys?

#171

Post by jwr »

robszumski wrote: post #104
jwr wrote: post #51

Here's what works for small and medium organizations for data which needs to be encrypted at rest, but is not often accessed (so, backups): 1. Buy a bunch of Yubikeys, minimum of 2. 2. Create GPG keys and store them on YubiKeys. Follow this guide: https://github.com/drduh/YubiKey-Guide (if you want to, keep the secret keys, but in case of multiple YubiKeys I would not keep them anywhere). Remember to set the keys to…

This is similar to a system I have seen, other than the inclusion of a dense QR code as the backup, stored in a secure safe. And you need to test the entire process from scan to key resurrection. We saw that our offline signing laptop's camera was low enough quality that it was very hard (but possible) to read the key, because it was so dense.

Yes, I do that, too. Data Matrix, not QR, but my keys do have paper backups.

Re: Ask HN: How does your company manage its encryption keys?

#172

Post by perlgeek »

varikin wrote: post #101
toomuchtodo wrote: post #4

https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…

This just pushed the problem further down the stack. You should have keys to unlock vault when it is restarted. How do you secure those keys?

There are actually two answers to that:

* You can split the key between different persons, and you can even implement "n of k" schemes, like you specify (at key creation time) that you need any 4 out of 9 shards to unseal the vault. You can then keep those shards on separate operator's laptops, in separate backup systems etc.

* You can use a hardware security module to unseal the vault (support for that is not included in the free version, IIRC).

But even if the vault wasn't stored encrypted, it'd still be a huge improvement over "keys on NFS", because only machine administrators get access to the whole DB, and you can limit and audit the access of everybody else in a sane manner.

Re: Ask HN: How does your company manage its encryption keys?

#173

Post by bvallelunga »

A couple of our customers shared this thread with me so I thought I’d chime in. For transparency I am the CEO of Doppler (YC W19), a hosted secrets manager service. I know secrets management isn’t directly related to key management, but it’s a cool security topic we think about often. A one-liner about Doppler - lovable secrets manager built for the everyday developer, that works across all stages, from local development to production, on all stacks, and infras.

For anyone who needs a super simple place to store their encryption keys that works with Heroku and has versioning, I think Doppler could help. It doesn’t have all the fancy (and really cool) features of KMS as it’s designed to be a kv store for secrets, but it could be helpful. We have a free tier for anyone who wants to try it out. https://doppler.com

Re: Ask HN: How does your company manage its encryption keys?

#174

Post by Faaak »

ahnick wrote: post #155
Faaak wrote: post #151

We use vault, but sometimes I just `openssl` gpg encrypt the secrets with the keys of all the members of my team and commit the .gpg to git. We all use yubikeys and use them to SSH. Not ideal, but it works... At least until one of us resign (but turnover is quite low here, so crossed fingers).

What is your process for handling key exchange with team members?

when a new guy arrives to the company, we generate the keys on an air-gapped computer (with cahoskey et al) and upload the to the yubikey (they keep a separate encrypted usb key with the private keys). Then, some employees verify the new employee and sign their keys. There are then uploaded to teh keyservers and an internal mail is sent.

Quite old school but it works quite well, alas we're small though (120).

Re: Ask HN: How does your company manage its encryption keys?

#175

Post by Predrag3141 »

d0ne wrote: post #163

Disclosure: Founder https://dev.ionic.com Utilized globally by individual developers, large enterprises such as JP Morgan & Chase[1], and integrated into the KMS services such as Google Cloud[2]. 1. https://venturebeat.com/2019/02/27/ionic-security-raises-40-... 2. https://cloud.google.com/blog/products/identity-security/clo...

dev.ionic.com is in particular an answer to, "how do you back up your encryption keys, or even put them in escrow somewhere?"

Re: Ask HN: How does your company manage its encryption keys?

#176

Post by shoo »

AlfeG wrote: post #112
eitland wrote: post #90

Earlier quoted context omitted.

Hehe. Less than 8 years ago I asked for help to add a column in a database at a company I helped. This was a few days after they met me for the first time. The company solved this by giving me a root username and password that worked on every single important database in the company, at least every customer database. I had to beg them to create a somewhat restricted account. The same company was however deeply scepti…

On one my past job there were fingerprint reader system on enter to office. Almost 6 years later, I were still able to enter office with my fingerprint.

At one of my past jobs there was a fingerprint reader system to enter the office. It didn't work reliably to recognise fingerprints of employees, so after a while people settled on the solution of having a large brick next to the door which was used to wedge the door open during the daytime after the first person managed to get the door open in the morning.

Re: Ask HN: How does your company manage its encryption keys?

#177

Post by tempestn »

eitland wrote: post #90
AlfeG wrote: post #74

Earlier quoted context omitted.

We have very simmiliar issue. All our databases have password Qwerty1234 Android keystore is checked in repository with access key in scripts. Security keys for external services are also checked in into repository. Some external services for production are managed by devs that are long time ago not working in our company

Hehe. Less than 8 years ago I asked for help to add a column in a database at a company I helped. This was a few days after they met me for the first time. The company solved this by giving me a root username and password that worked on every single important database in the company, at least every customer database. I had to beg them to create a somewhat restricted account. The same company was however deeply scepti…

With root access I suppose you could have created a restricted account yourself!

Re: Ask HN: How does your company manage its encryption keys?

#178

Post by clintfred »

https://github.com/IronCoreLabs/ironhide is a tool we built for managing our own developer secrets. It allows encrypted files to be checked in to git or stored elsewhere. You can think of it similar to gpg, with the upside that ironhide has the ability to change who can decrypt the secret without re-encrypting the data.

Check it out and if you have any questions, feel free to ask here or open an issue in github. We also have a Rust version in the works for those interested in something native.

Re: Ask HN: How does your company manage its encryption keys?

#179

Post by clintfred »

thieving_magpie wrote: post #14

Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.

I posted elsewhere about https://github.com/IronCoreLabs/ironhide a tool purpose built for sharing developer/CI secrets.

Re: Ask HN: How does your company manage its encryption keys?

#180

Post by ComputerGuru »

We commit encryption keys, themselves encrypted, to git alongside the code and everything else. They’re fully versioned and therefore protected against data loss, and we don’t treat dev keys as any different from production keys (just stored in a separate file).

I first wrote about it back in 2017 (1) and we released an open framework for multiple languages/frameworks (2).

1: https://neosmart.net/blog/2017/securestore-a-net-secrets-man...

2: https://neosmart.net/blog/2020/securestore-open-secrets-form...

Post reply on HN