21–27 of 27 posts
A shared workspace for secrets as long as none of your friends using Windows, Android or iOS have secrete to share, apparently.
Doesn't solve the lack of mobile support, but hopefully the fact that the client-side code is already free software (and under a liberal license, to boot) means that the community can fix that problem if all else fails.
How is using an online service as a starting point for security a good thing?
It looks like there are plans to open-source the server, though, so that problem can be solved if you want to host your own Torus deployment (which I'd likely do for any serious non-personal usage).
Looks interesting. I'll definitely take a look at how this compares to Hashicorp Vault. Definitely getting closer and closer to the point where I can start to properly utilize a tool like this. Reading the docs, though, it does seem like it's one legendary AWS outage away from being a huge problem: >Torus’s infrastructure has been designed from the ground up for resilience without any single point of failure. All of…
Maybe it's not a good idea to launch in the default region.
How is using an online service as a starting point for security a good thing?
As long as everything's encrypted on the client-side (and the client's source code is available for public audit), I don't see any immediate concerns besides the obvious one of "what happens if Torus goes under?". It looks like there are plans to open-source the server, though, so that problem can be solved if you want to host your own Torus deployment (which I'd likely do for any serious non-personal usage).
As soon as developers have access to the production credentials it's game over. Auditability is gone. Passwords end-up being stored in various password stores and plain files because it's convenient. Developers connect to the production system and start doing live changes. Hashicorp Vault is more difficult to put in place but it does the right thing. With it's custom backend it can generate temporary tokens, for exam…
Heck, how do people manage their personal credentials and secrets? I have a few computers, and I usually copy over a few PGP keys, SSH keys, and API keys. For regular credentials, I use a password manager which syncs through a cloud data storage system.
One of the best sites I've found for learning about security-related topics is the NIST CSRC [0]. They cover a huge variety of topics, with varying levels of detail. I've found many of their publications to be very approachable. For example, they usually include a glossary of terms and acronyms, along with examples to help you understand the problem. Also, unlike what you find in many popular books or random online blogs, they actually cover varying edge-cases and discuss an example of what a real-world solution could do. I love that because it gives you a reasonable starting point for when you don't know any better. The only problem is that their content generally isn't written with personal usage or small teams in mind.
Earlier quoted context omitted.
Could you highlight differences compared to Vault?
At it’s heart, Torus is public-key infrastructure, users/machines derive and encrypt asymmetric key pairs from their password. These key pairs are then uploaded and signed by the Torus server using a key endorsed by our root signing keys (always kept offline in a sealed and secured environment). This enables Torus to establish a web of trust (much like gpg), allowing clients to retrieve and validate (by navigating do…
It doesn't complicate anything. It just makes it secure.
> If the root key were to be lost or compromised, then all of the secrets would be as well.
In Vault, you do not have just a root key. You have it divided, initially in 5 parts 3 of which are needed for unsealing. You can change the numbers. It is unlikely that all of them goes AWOL.
Plus, Vault is trivial to set up for a small team. Not a bigger effort is needed to set up a cluster.
I can understand that Torus is your tool of choice, but please do not spread FUD about Vault at the same time. I have no experience with Torus, yet, but Vault is a solid piece.
As soon as developers have access to the production credentials it's game over. Auditability is gone. Passwords end-up being stored in various password stores and plain files because it's convenient. Developers connect to the production system and start doing live changes. Hashicorp Vault is more difficult to put in place but it does the right thing. With it's custom backend it can generate temporary tokens, for exam…
Hashi Vault isn't that difficult to setup, especially for smaller setups, it's basically just a binary you run, with the file backend. You still get the auditing goodness, etc. Otherwise I agree with what else you said.