Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets • Hacker News Board

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#41

Post by tompic823 » Thu, Oct 08, 2020, 5:14 PM UTC

lucasverra wrote: post #37

hey there, congrats on this launch. I'm looking for something like this for login passwords that i can share with a headless browser (SaaS) service for managing authen into services. That way i only have to trust one service and not los of headless browser services Can it be used that way ?

Absolutely, we use Doppler ourselves in this way with puppeteer for our E2E tests. You would simply wrap your orchestrator (like puppeteer) with our Doppler CLI [0] to make the secrets available via environment variables. For example, `npm start` would now be `doppler run -- npm start`.

[0] https://github.com/DopplerHQ/cli

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#42

Post by gen220 » Thu, Oct 08, 2020, 5:15 PM UTC

shay_ker wrote: post #25

tompic823 wrote: post #17

Earlier quoted context omitted.

Great point about dynamic secrets. This is an area we currently don't address, but it is definitely on our roadmap. There is a segment of the market for which dynamic secrets are an absolute requirement and we fully acknowledge that.

Just out of curiosity - what do people use dynamic secrets for? What is a "dynamic" secret anyway?

At our company, we use vault to generate and cycle short-lived database credentials and tls certs. Our RPC services use the certs to encrypt their traffic amongst each other, and also to enforce RBAC (since the certs are traceable, via vault, to a service or individual's identity).

"Dynamic" secrets imply that rotation is automated and frequent, and that there are no "blessed" certs, but rather that all certs/keys are generated in exchange for a successful identity assertion.

For example, if I can prove that I am LDAP user gen220, who belongs to group db-x-developer, I have earned the right to request a credential for connecting to db-x, which expires some arbitrary time before my identity-assertion expires.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#43

Post by shay_ker » Thu, Oct 08, 2020, 5:22 PM UTC

quaffapint wrote: post #33

shay_ker wrote: post #25

Earlier quoted context omitted.

Just out of curiosity - what do people use dynamic secrets for? What is a "dynamic" secret anyway?

A simple example that we use them for is for dynamic database credentials. So you no longer define a static username/password. You request the access/credentials from vault as you need them.

how does that actually work? Vault has the user/password, and then acts as a gateway to the db?

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#44

Post by onei » Thu, Oct 08, 2020, 5:25 PM UTC

tompic823 wrote: post #29

meagher wrote: post #24

Looks great! What happens if Doppler is down or if there is a SNAFU when syncing the env in production?

Great question! We address this in detail on our Security page [0], but I'm happy to give a high-level overview here: 1. Don't go down! We run two independent compute clusters on different managed infrastructure products (GKE and GAE) and route between them at the DNS layer to help avoid downtime 2. We store local encrypted fallback files on your infra via our CLI [1]. These local fallback files are fully managed and…

Is there a scenario where the CLI fallback gets out of sync and you may as well not have the fallback? How is the fallback file secured and what's stopping someone else from accessing those secrets of they can get at the encrypted file itself? Finally, what if a disgruntled ex-employee still has that fallback - can access be revoked reliably even if your API is down or they just turn off the internet connection?

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#45

Post by danenania » Thu, Oct 08, 2020, 5:45 PM UTC

drcongo wrote: post #15

gingerlime wrote: post #9

Congrats on the launch. Great to see more products in this space. I'm also familiar (but never used) Envkey, which I think might also be from the YC alumni? but I'm not sure... Shameless plug: I created an open-source tool called envwarden[0], which is really just a simple wrapper around the Bitwarden[1] CLI (also open-source). envwarden helps you manage your server secrets and other variables inside your Bitwarden p…

Super happy user of EnvKey here - I'd be interested to hear what sets Doppler apart.

Founder of EnvKey here. I'm glad to hear you're a happy user :)

There's certainly room for alternatives in this space! I'd say the major difference from my perspective is that EnvKey uses client-side end-to-end encryption and a signed desktop application instead of a web app interface, giving it quite a different security and trust model than Doppler.

Because Doppler is delivered as a web app, its users are implicitly trusting Doppler's servers on every request. If their servers were compromised, user data would be at risk despite any tokenization or encryption they might be using on the back end, because the attacker could simply inject malicious javascript into the html of the initial web app request. EnvKey's architecture doesn't allow this.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#46

Post by qchris » Thu, Oct 08, 2020, 5:47 PM UTC

tompic823 wrote: post #2

Tom here from Doppler. I'm a founding engineer at Doppler and work on most of our security. Feel free to hit me with any security questions about our product, philosophy, etc.

Hi, congrats on the launch! Potentially a little off topic, but I'm curious how you came up with the name Doppler. After the audio effect, or the Witcher creature, or something else entirely?

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#47

Post by tompic823 » Thu, Oct 08, 2020, 5:56 PM UTC

danenania wrote: post #45

drcongo wrote: post #15

Earlier quoted context omitted.

Super happy user of EnvKey here - I'd be interested to hear what sets Doppler apart.

Founder of EnvKey here. I'm glad to hear you're a happy user :) There's certainly room for alternatives in this space! I'd say the major difference from my perspective is that EnvKey uses client-side end-to-end encryption and a signed desktop application instead of a web app interface, giving it quite a different security and trust model than Doppler. Because Doppler is delivered as a web app, its users are implicitl…

Hey Dane- totally fair points. Agreed that Doppler and EnvKey have different threat models. Regarding your point about malicious JavaScript- I'd encourage you to take a look at our Content Security Policy. We've gone to great lengths to explicitly disallow all unsafe-inline JavaScript (technically in report mode, but will be moved to block mode within the next few days). This is just one of many things we do to help keep our users secure, but I figured it was worth addressing directly. We've also undergone extensive internal and external audits and pentests to ensure we're not susceptible to XSS and CSRF (and employ development practices to prevent us from introducing these vulns).

I'd also argue that EnvKey might be a bit too absolutist about security, in that we think the user experience greatly suffers as a result. We have a different tradeoff that emphasizes secure defaults and best practices while also allowing for necessary features like audit logs and syncing with different infra providers. We spent quite a bit of time considering the tradeoffs of zero-trust, but our user experience would suffer as a result, and so we have taken a different approach.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#48

Post by armatav » Thu, Oct 08, 2020, 5:58 PM UTC

I've been waiting for something this easy.

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#49

Post by tecleandor » Thu, Oct 08, 2020, 6:00 PM UTC

shay_ker wrote: post #43

quaffapint wrote: post #33

Earlier quoted context omitted.

A simple example that we use them for is for dynamic database credentials. So you no longer define a static username/password. You request the access/credentials from vault as you need them.

how does that actually work? Vault has the user/password, and then acts as a gateway to the db?

IIRC, Vault has plugins with GRANT access to your database, and rotates your passwords automatically. So it is able to create new users when access is requested, and to rotate passwords if needed.

https://www.vaultproject.io/docs/secrets/databases/mysql-mar...

Re: Launch HN: Doppler (YC W19) – Easily manage your env vars and secrets

#50

Post by kenanpulak » Thu, Oct 08, 2020, 6:03 PM UTC

We were using AWS SSM previously which got exponentially more difficult to manage with each service we added, we had stumbled upon Doppler while spinning up a new service and decided to give it a shot. We've been using Doppler for over a year and it's saved us a lot of developer hours on managing secrets and improved our dev workflows significantly.