Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How does your company manage its encryption keys?

news.ycombinator.com

Post reply on HN
Print view View original

241–246 of 246 posts

Re: Ask HN: How does your company manage its encryption keys?

#241

Post by yencabulator »

jeremygaither wrote: post #237
yencabulator wrote: post #225

Earlier quoted context omitted.

An elliptic curve key (NaCl etc) is 32 bytes. Here's two such keys for you, as a demo: $ entropy 32|zbase32-encode pu3zrux6t6cqrmmyesdxtppxiudxjcndrx3bomjuyaupa61493no $ entropy 32|phrase-encode afar-pimple-unwind-imagine-buckets-today-duke-sober-dehydrate-rebel-online-nudged-bamboo-saxophone-eluded-tattoo-pause-bays-ungainly-tasked-jingle-topic-null-enraged

My Google fu has failed me. What is that "phrase-encode" tool and where can I find it?

It's a 50-line CLI I wrote (just like `entropy` on the other line). It's just a simple interface for https://gitlab.com/NebulousLabs/entropy-mnemonics which is one of the many different "encode binary as words" things out there. It's the idea that matters more.

Re: Ask HN: How does your company manage its encryption keys?

#243

Post by gerritjvv »

the simplest option is to store your keys in aws secrets manager (if you use aws), and then write some tooling around it.

self promotion * You did ask how people do it :), this is my way, Ive written my own service which has been in production for more than 3 years, http://pkhub.io (if you would like to try it send me an email to admin@pkhub.io). This was before aws secrets manager, the tooling is usefull cause I wrote: running your app with its needed secrests dev/stage/prod, accessing dbs, downloading and installing ssh keys to ssh agent, utilities.. end

of course you could write all these yourself with aws secrets manager.

there is hashicorp's vault but tbh it always seemed like way to complicated to setup.

my advice in general would be: to get something secure but simple enough that your engineers can do their work and access the resources they need, without the oh only bob has the keys on his laptop situation.

Re: Ask HN: How does your company manage its encryption keys?

#244

Post by zemnmez »

baby wrote: post #216
zemnmez wrote: post #97

Earlier quoted context omitted.

This is the best answer I know of. A secret management system is what you want, for several reasons: 1) Secrets checked into code means when the code gets stolen, this is an unimaginably major breach. Code tends to get stolen eventually and most tech shops will never know / only know years later because they don't have access to the channels who will sell your code. 2) You can track secrets you have in storage, who h…

I'm always a bit antsy about Vault. You do end up having all your secrets in one place.

'in one place' is i think using a model of security that's too simple to think about the way Vault works. Those secrets can only be properly decrypted by the right services. To everyone else, they're just noise.

Re: Ask HN: How does your company manage its encryption keys?

#245

Post by awayfromme »

Hi, this issue brought me back in the days when i was just a IT handyman in a small company. The priority of that company was to don't share keys or everything related to them with no one. For no one i mean, third-parties software of wherever a password or an encryption would be watched to someone. At the time, i thought this "obsession" was clearly a sign of mental illness, cause the company was very small and we were in the nowhere of nothing.(maybe nowdays i still think it). Our method was based on a selfmade MD5 encryption script using ruby on rails. Put your password into it, it print it on a datacoin blockchain that generates a univocal MD5 hash. This hash goes around 5 (later 6) local server those collect the encrypted key. Obviously these servers were without an internet connection, running only for internal company purposes.(such as this). For sure a weakness of this procedure was the slowness for obtain a new password or to change it. I think that the most secure place is where there'snt an internet connection. Thanks for bring back memories :D

Re: Ask HN: How does your company manage its encryption keys?

#246

Post by vedant_shety »

eitland wrote: post #90
AlfeG wrote: post #74

Earlier quoted context omitted.

We have very simmiliar issue. All our databases have password Qwerty1234 Android keystore is checked in repository with access key in scripts. Security keys for external services are also checked in into repository. Some external services for production are managed by devs that are long time ago not working in our company

Hehe. Less than 8 years ago I asked for help to add a column in a database at a company I helped. This was a few days after they met me for the first time. The company solved this by giving me a root username and password that worked on every single important database in the company, at least every customer database. I had to beg them to create a somewhat restricted account. The same company was however deeply scepti…

This feels awfully familiar. My current company uses the same generic username-password combination for every server.

But we aren't allowed internet access on our workstations because "security"

Post reply on HN