Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

v2.envkey.com

Post reply on HN
Print view View original

31–40 of 67 posts

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#31

Post by danenania »

itake wrote: post #26
danenania wrote: post #22

Earlier quoted context omitted.

You're right--another distinction is needed here. For a human user using EnvKey, the EnvKey 'core-process' will run on their computer. Both the EnvKey UI and the CLI talk to this core process to fetch/display data or make updates. This is the process that will periodically evict secrets from RAM if they aren't used. When loading a single environment via an ENVKEY access key, you're correct that there is no RAM evicti…

Those cmds write the variables unencrypted to disk? Looking at the ruby sdk, I don't see any decryption libraries being used. I'd imagine a more secure solution would be to give the sdk the decryption key when the variables need to be decrypted, they are only decrypted by the process in RAM. Since its ruby, and everything has access to everything in the process, it might make more sense to key management to exist in…

Yes, those commands write the variables to a file, though you could also make a system call instead from within your app if you didn't want them in a file or environment variables.

The language SDKs (including ruby) wrap the envkey-source binary, which is where all the decryption and verification logic lives:

https://docs-v2.envkey.com/docs/envkey-source

There is an -m/--mem-cache flag that you can pass to envkey-source that makes it work just as you're describing. It keeps the variables in RAM and listens for updates, keeping them all up-to-date.

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#32

Post by danenania »

tener wrote: post #25

How do you handle a situation where the attacker gains access to decrypted set of secrets and steals them? Can you prevent this scenario in any way, or does single hacked admin results in a complete compromise with no way to recover?

If an attacker gains access to your app's process where the secrets are in RAM, there's not much protection we can offer, since ultimately the variables need to live in plaintext somewhere in order to be used. But recovering is a lot easier/faster since you can track down exactly what was exposed with audit logs and rotate compromised credentials in one place instead of needing to track them down across many devices/servers.

For a human user, there are multiple layers of security: email/SSO authentication, a per-device encryption key (stored in the OS credential store on Mac/Windows), and, optionally: a passphrase that locks the per-device encryption key and a lockout that clears RAM and locks EnvKey on the device after a specified time period until the user inputs their passphrase. EnvKey organization owners can require that passphrases/lockouts be set for all org members.

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#33

Post by ocdtrekkie »

danenania wrote: post #13
mattste wrote: post #8

How does this compare to Doppler[1]? Is there a way to handle the configuration in Terraform? [1] https://www.doppler.com/

I've met the Doppler founders and greatly respect them (even played some poker with them!). Doppler has great design and UX. That said, I'd say the key difference is that EnvKey places much more emphasis on security and privacy. Doppler is cloud-hosted and doesn't use end-to-end encryption, so it requires that you trust them to keep your data safe and not make any mistakes in their data security, network security, wh…

> I don't believe browsers are sufficiently secure currently for secrets management

This is a super rare view, but one I truly appreciate. The risk of compromised browser plugins especially is vastly understated and underappreciated by... way too many "security" "experts".

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#34

Post by danenania »

KMag wrote: post #28
danenania wrote: post #21

Earlier quoted context omitted.

Thanks, I'll have to look into this more deeply. Currently cleanup is being left to the watched process, but it sounds like more rigorous monitoring of grandchild processes is needed.

Also, after you SIGTERM/SIGKILL your child processes, you check their exit statuses, right? Otherwise your child processes also sit around as zombie processes until you exit, the zombie orphans become children of init, and init properly "reaps" the zombies by checking their exit statuses.

The process management code lives here: https://github.com/envkey/envkey/blob/main/public/sdks/envke...

Basically, on unix systems, the command you pass in to envkey-source is run via:

exec.Command("sh", "-c", c)

(c is the command you passed as a string.)

Stdout/stderr is piped through, and .Wait() is called on the command. If envkey-source is in watch mode, it will send a SIGTERM when the environment is updated, then re-run the process once the initial process has died. I can verify that, for example, if a server listening on ports is restarted in this way, the process will die and the ports will be cleared before the new process is started (this has been well-tested).

Do you see a problem with this approach? We will prioritize making all this bulletproof.

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#35

Post by 998wwwww »

danenania wrote: post #30
zmxz wrote: post #24

How is this tool different to Hashicorp's Vault? Also, if I'm using "Enterprise Self Hosted", which means I am doing the hosting myself - am I not responsible for all the protection features you outlined there? If it's on my hardware, I'm doing the backups, patches, DDOS protection and so on? I'm sorry if I sound blunt, but the pricing page looks like you tried to enlist as many buzzwords as possible to sound relevan…

Thanks for your feedback. Enterprise Self-Hosted runs in an AWS account that you control. It uses AWS Aurora and Fargate, along with a handful of other AWS supporting services. Auto-scaling, high availability, a private network, backups, patches, and DDOS protection are all built-in. The goal is to make running self-hosted, production-ready EnvKey as easy and hands-off as possible. All the details on setup, deploymen…

Why does client side encryption matter? explain it like I'm 5 please

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#36

Post by danenania »

998wwwww wrote: post #35
danenania wrote: post #30

Earlier quoted context omitted.

Thanks for your feedback. Enterprise Self-Hosted runs in an AWS account that you control. It uses AWS Aurora and Fargate, along with a handful of other AWS supporting services. Auto-scaling, high availability, a private network, backups, patches, and DDOS protection are all built-in. The goal is to make running self-hosted, production-ready EnvKey as easy and hands-off as possible. All the details on setup, deploymen…

Why does client side encryption matter? explain it like I'm 5 please

If the host server is compromised, attackers still will not be able to access secrets.

Vault attempts to mitigate this with its 'seal' functionality, but in practice if an attacker gains access to a running Vault server, and/or the cloud provider account it's running in, there are many ways that secrets could be exposed.

EnvKey allows you to avoid trusting the host server, full stop.

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#38

Post by ryukafalz »

ocdtrekkie wrote: post #33
danenania wrote: post #13

Earlier quoted context omitted.

I've met the Doppler founders and greatly respect them (even played some poker with them!). Doppler has great design and UX. That said, I'd say the key difference is that EnvKey places much more emphasis on security and privacy. Doppler is cloud-hosted and doesn't use end-to-end encryption, so it requires that you trust them to keep your data safe and not make any mistakes in their data security, network security, wh…

> I don't believe browsers are sufficiently secure currently for secrets management This is a super rare view, but one I truly appreciate. The risk of compromised browser plugins especially is vastly understated and underappreciated by... way too many "security" "experts".

I don’t believe just about any platform we have now is really sufficiently secure for secrets management. Just as a compromised browser plugin can do a lot of damage, so too can a compromised desktop application (including its dependencies). The industry as a whole is not in a great place when it comes to protecting the integrity of our machines, especially developer workstations.

(And yes I know you probably know this better than most as a Sandstorm dev :)

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#39

Post by gmfawcett »

danenania wrote: post #34
KMag wrote: post #28

Earlier quoted context omitted.

Also, after you SIGTERM/SIGKILL your child processes, you check their exit statuses, right? Otherwise your child processes also sit around as zombie processes until you exit, the zombie orphans become children of init, and init properly "reaps" the zombies by checking their exit statuses.

The process management code lives here: https://github.com/envkey/envkey/blob/main/public/sdks/envke... Basically, on unix systems, the command you pass in to envkey-source is run via: exec.Command("sh", "-c", c) (c is the command you passed as a string.) Stdout/stderr is piped through, and .Wait() is called on the command. If envkey-source is in watch mode, it will send a SIGTERM when the environment is updated, the…

In the short term you could just tell people to use your 'eval' approach, and punt on the issue. :)

Looking at your code, what's missing is a SIGCHLD handler. Basically, your code doesn't know when one of its children dies. You're making an assumption that you know how many children you currently have, based on how many you spawned; but this is misleading due to PID1 semantics re: orphaned processes.

SIGCHLD lets you know that a child process has died. For each SIGCHLD received, your program should (must!) call 'waitpid' (or one of its related functions) to wait on the dead child process. You don't need to waitpid inside the signal handler; you just need to make sure that the counts of signals and waitpid calls eventually match up.

This is in a different language, but here's a nicely writen article about implementing PID1 in Rust:

https://www.fpcomplete.com/rust/pid1/

Someone in Go-land must have written a similar module. Your solution might be an 'import' away.

Re: Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

#40

Post by danenania »

weinzierl wrote: post #37

Is it a replacement for ansible-vault too? What are the advantages of a solution involving a server?

For many platforms and tools (like Ansible) that offer some form of secrets management, instead of being a complete replacement, EnvKey piggy-backs on whatever is the standard secrets management approach, then adds a lot of functionality and security on top.

That's because EnvKey doesn't (and can't) completely eliminate the secrets you have to manage, but it does minimize them to a single secret (the ENVKEY) for each environment.

So now instead of setting a bunch of variables in ansible-vault, in Kubernetes secrets, in AWS secrets manager, etc. etc. for every environment that you run, you can just set a single ENVKEY in each of those tools, and then access/update/manage everything in a single place with all the productivity features and additional security that EnvKey offers.

Post reply on HN