Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 124 posts

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#11

Post by ianpurton »

Hi. I'm also working on an E2E secrets manager. https://github.com/purton-tech/cloak

A few tips.

1. It looks like I'm able to do account enumeration on your login page. For a secure app you want to make sure this is not possible.

2. Your CSP https://csp-evaluator.withgoogle.com/ has unsafe-eval. I would lock that down.

3. Your app seems to be JS based, which is OK but it means you have a whole bunch of supply chain attacks on nodejs to worry about. You should only run the bare minimum JS on the frontend when dealing with encryption keys.

4. You're storing keys in local storage. There's a trick you can do, if you store an actual CrypoKey object instead of a string and set non extractable to true you can stop JS extracting private keys.

5. For key stretching looks like your using Argon2-browser. Actually browsers come with a built in with PBKDF2 that runs faster than a JS based argon. So I'm able to get 10 million iterations in a few seconds which is an NIST recommendation.

6. Some of your dependencies look like they are not maintained anymore. i.e. argon2-browser.

This is what I was able to find so far. Hope this helps.

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#12

Post by nonethewiser »

vmatsiiako wrote: post #7
Terretta wrote: post #5

OK, aside from "open source", and assuming clients will be comparing paid enterprise to paid enterprise, how would you describe your value prop relative to Doppler?

2 main points: - Infisical is by default end-to-end encrypted which means that we are not able to read you secrets (unless you give us explicit permissions for integrations that require it). This is not the case for many other products in the market, like Doppler. - "Open source" is actually a big differentiator in this case, because people and companies can self-host Infisical on their own infrastructure. I can't re…

How does getting permission make you “able” to read secrets? It seems like maybe you can read everyone’s secrets but you’re promising not to.

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#13

Post by ensignavenger »

As soon as I see a product is open core, I immediately start wondering what critical features are going to be proprietary. I don't see this information immediately on your website- is there a page where you outline what features you plan to keep proprietary?

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#14

Post by vmatsiiako »

candiddevmike wrote: post #10
vmatsiiako wrote: post #7

Earlier quoted context omitted.

2 main points: - Infisical is by default end-to-end encrypted which means that we are not able to read you secrets (unless you give us explicit permissions for integrations that require it). This is not the case for many other products in the market, like Doppler. - "Open source" is actually a big differentiator in this case, because people and companies can self-host Infisical on their own infrastructure. I can't re…

If being open source is such a big differentiator, why do you not reference it on your pricing page at all? https://infisical.com/pricing I really wish companies would stop using open source as a growth hack.

It is actually mentioned on the pricing page! (in one of the FAQ questions)

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#15

Post by warp »

I thought there were a bunch of dead links on the page, but looking closer it's actually the "Star us on GitHub" banner extending some invisible element to the bottom of the page and blocking certain elements from being clicked on. (Firefox 111 on mac).

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#17

Post by vmatsiiako »

ensignavenger wrote: post #13

As soon as I see a product is open core, I immediately start wondering what critical features are going to be proprietary. I don't see this information immediately on your website- is there a page where you outline what features you plan to keep proprietary?

Right now most of the features are available under the MIT license. For example, absolutely all the integrations, CLI, API, etc are available like that.

Basically, all the features that are needed by individuals and small teams will always stay completely free.

Some of the features that we are thinking to make proprietary are audit logs, sso, role-based access controls. Would love to hear your thoughts on this, because this is still in the very active stage of development!

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#18

Post by vmatsiiako »

warp wrote: post #15

I thought there were a bunch of dead links on the page, but looking closer it's actually the "Star us on GitHub" banner extending some invisible element to the bottom of the page and blocking certain elements from being clicked on. (Firefox 111 on mac).

Thank you for pointing this out! Will try to fix this right now!

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#19

Post by dangtony98 »

nonethewiser wrote: post #12
vmatsiiako wrote: post #7

Earlier quoted context omitted.

2 main points: - Infisical is by default end-to-end encrypted which means that we are not able to read you secrets (unless you give us explicit permissions for integrations that require it). This is not the case for many other products in the market, like Doppler. - "Open source" is actually a big differentiator in this case, because people and companies can self-host Infisical on their own infrastructure. I can't re…

How does getting permission make you “able” to read secrets? It seems like maybe you can read everyone’s secrets but you’re promising not to.

This has to do with how our underlying cryptography works; it's end-to-end encrypted by default with opt-out ability for integrations that need it. You'd have to manually login to Infisical and grant that permission but the platform itself would be unable to read your secrets otherwise.

Technical details: In Infisical, secrets are stored in vaults (we call them projects). They are encrypted symmetrically by vault keys for which there are multiple copies of vault keys encrypted under the public key of each vault member (your teammates). Vault members decrypt their copy of the vault key locally and use that to decrypt secrets (in browser or via CLI similar to platforms like 1Password and Bitwarden); this client-side decryption process makes it impossible for the platform itself to decrypt the secrets itself.

What is meant by users having the ability to give permission to Infisical to access/read secrets is to share a copy of the vault key by encrypting it under one of the public keys of Infisical — we employ an abstract concept of "bots" that have public-private key pairs assigned to each vault. When you share a copy of the vault key with Infisical (which can't happen without your explicit action), it grants Infisical the ability to access your secrets for integrations like Vercel, Render, GitHub, etc.

Re: Launch HN: Infisical (YC W23) – Open-source secrets manager for developers

#20

Post by nicoburns »

nonethewiser wrote: post #12
vmatsiiako wrote: post #7

Earlier quoted context omitted.

2 main points: - Infisical is by default end-to-end encrypted which means that we are not able to read you secrets (unless you give us explicit permissions for integrations that require it). This is not the case for many other products in the market, like Doppler. - "Open source" is actually a big differentiator in this case, because people and companies can self-host Infisical on their own infrastructure. I can't re…

How does getting permission make you “able” to read secrets? It seems like maybe you can read everyone’s secrets but you’re promising not to.

Presumably the permissions switch is in the client rather than the server. It's true that you have to trust the client, but that's unavoidable.
Post reply on HN