Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Send encrypted secrets from the command line

fluidkeys.com

Post reply on HN
Print view View original

21–30 of 43 posts

Re: Show HN: Send encrypted secrets from the command line

#21

Post by paulfurley »

xvector wrote: post #18
tzs wrote: post #17

Earlier quoted context omitted.

They should add support for the OpenPGP Web Key Directory [1] system. Briefly, the idea is that the public key for user@example.com should be available at " rel="nofollow">https://example.com/openpgp/hu/ where is generated as described in the document. Gpg supports looking up keys via this since 2.1.12 [2]. An example of how to lookup and get a key this way can be seen here [3]. [1] https://tools.ietf.org/html/draft-…

This is a clever idea. Unfortunately, it doesn't seem like most mail providers would store something like this.

I can't see Gmail doing it :)

But mostly teams control their own mail domain, so they can do what they like (for example, use Fluidkeys, and we'll do WKD for them!)

Re: Show HN: Send encrypted secrets from the command line

#22

Post by 0xb100db1ade »

mkagenius wrote: post #15

On a side note, PSA: do not commit your AWS keys into github. Also, now you have the ability to make your repos private. Head over and do it now.

Also PSA: if you ever decide to make said repo public, `git push --force` does not make the old commits unaccessible; doing so is not a secure way to remove secrets from a git remote before making it public

Re: Show HN: Send encrypted secrets from the command line

#23

Post by BillinghamJ »

To be honest this just seems like an insecure version of Keybase.

The key thing with Keybase is that it cryptographically verifies your public keys against public statements published to accounts people know you by - eg your Twitter, Facebook, etc.

The difficult bit isn't encrypting and sending. The difficult bit is the original key exchange. Keybase has dealt with this without you having to trust Keybase itself.

Re: Show HN: Send encrypted secrets from the command line

#25

Post by StavrosK »

j1vms wrote: post #24

Nice to see more solutions like these pop up. Another great one is Magic Wormhole, which uses a parallel human-to-human channel to negotiate a secure machine-to-machine exchange: https://github.com/warner/magic-wormhole

I've been using Magic Wormhole for all my peer-to-peer file transfers and love it.

Re: Show HN: Send encrypted secrets from the command line

#26

Post by walterbell »

StavrosK wrote: post #25
j1vms wrote: post #24

Nice to see more solutions like these pop up. Another great one is Magic Wormhole, which uses a parallel human-to-human channel to negotiate a secure machine-to-machine exchange: https://github.com/warner/magic-wormhole

I've been using Magic Wormhole for all my peer-to-peer file transfers and love it.

Who runs the rendezvous server for MW?

Re: Show HN: Send encrypted secrets from the command line

#27

Post by paulfurley »

j1vms wrote: post #24

Nice to see more solutions like these pop up. Another great one is Magic Wormhole, which uses a parallel human-to-human channel to negotiate a secure machine-to-machine exchange: https://github.com/warner/magic-wormhole

Ooh this looks awesome, thanks for sharing.

Re: Show HN: Send encrypted secrets from the command line

#28

Post by huhtenberg »

paulfurley wrote: post #16
huhtenberg wrote: post #8

Nicely done. One nitpick would be that initial peer key discovery looks a bit iffy. Do I understand correctly that fk fetches it from a key registry that is hosted by you? Is a self-hosted version of the same possible? Additionally, there should probably be a) Some sort of "paranoid" mode whereby it would show me peer's key (in some form) so that I could, if really wanted, manually verify it. b) An option to cache pe…

Thanks! Yes, we're currently hosting public keys. > Is a self-hosted version of the same possible? The honest answer is, we're not sure yet. It's our strong ambition to make Fluidkeys into an honest, you're-the-customer business, and we aren't sure how we'll license the server. Is self-hosting something your team would be willing to pay for? If so, that might help our business model development! :) > a) Some sort of…

> It's our strong ambition to make Fluidkeys into an honest, you're-the-customer business

Without sugar-coating it - a service like this, with the scope it has now, has * zero * chance of successful monetization. 100% guaranteed.

This is a cosmetic service that aims to address a security need. People who actually need this AND have money to pay for it are in position to explore self-hosted options, which is what they will be looking for in the first place since they DO want proper security. Having a random third party in their security pipeline is not really an option. And people who are not concerned with this part, won't think twice about sending API keys over regular email. In fact, even security-minded people won't have much objection to relaying secrets through their corporate, properly secured email server.

Then, there's an option of productized (self-hosted) version. This is not likely to work either, because the whole thing looks rather trivial and, put bluntly, not worth paying for. Like you aren't likely to pay for hugs, no matter how good they are. Same here - nice to have, but only if free.

All that said, the website is nicely designed and the whole thing is well-presented. It certainly has a potential to be a good demo/promo piece for something larger.

Re: Show HN: Send encrypted secrets from the command line

#30

Post by Boulth »

tzs wrote: post #17
paulfurley wrote: post #10

Earlier quoted context omitted.

> We use our own server to store public keys and transmit encrypted secrets. > We chose not to use the public keyserver network until it supports deleting keys and cryptographic validation. ... as well as the fact that there's no email validation, yep!

They should add support for the OpenPGP Web Key Directory [1] system. Briefly, the idea is that the public key for user@example.com should be available at " rel="nofollow">https://example.com/openpgp/hu/ where is generated as described in the document. Gpg supports looking up keys via this since 2.1.12 [2]. An example of how to lookup and get a key this way can be seen here [3]. [1] https://tools.ietf.org/html/draft-…

I was just going to ask the same question about WKD support. Having control over key distribution in an organization is a very important factor for me.
Post reply on HN