Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How does your company manage its encryption keys?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 246 posts

Re: Ask HN: How does your company manage its encryption keys?

#71

Post by nocman »

nihil75 wrote: post #54

We use cloud-provider managed encryption because we're not paranoid and don't have legal requirements to manage our own keys. We don't have SSH keys because it's not the 90's and we don't have servers.

> We don't have SSH keys because it's not the 90's and we don't have servers.

This seems unnecessarily snarky.

There are lots of businesses in 2020 that still maintain their own servers, use ssh keys, and are staffed by admins and developers who very much know what they are doing (and are not at all "behind the times", as this comment seems to imply such businesses are).

If that's not what you meant, well, OK, but I find it difficult to interpret it any other way.

Re: Ask HN: How does your company manage its encryption keys?

#73

Post by 2mol »

parasec wrote: post #66

The more complex your system grows, the more often it will fail and shoot you in the foot. I'd advise against systems like Hashicorp Vault - they just increase the complexity and while they have their merits in complex setups, you seem to be too small to be able to operate such a system. Have an offline backup printed along with the disaster recovery checklist and documentation and put them in a safe in your company…

Great answer, thank you. I agree with your point about testing the restore process, right now I'm trying to think of a way to automate it.

As a side note: for example we had some backups that are probably useless, because they are way too small. Catching this would mean more manual regular checks, or some automated rules, at which point it becomes quickly more complex again.

Re: Ask HN: How does your company manage its encryption keys?

#74

Post by AlfeG »

thieving_magpie wrote: post #14

Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.

We have very simmiliar issue. All our databases have password Qwerty1234 Android keystore is checked in repository with access key in scripts. Security keys for external services are also checked in into repository. Some external services for production are managed by devs that are long time ago not working in our company

Re: Ask HN: How does your company manage its encryption keys?

#75

Post by bloopernova »

When managing/deploying code we use SOPS (Secrets OPerationS) https://github.com/mozilla/sops

For standard password style secrets used by Ops, we use Team Password Manager. Which we chose about 5 years ago because it was self-hosted, the database was encrypted, and it had fantastic audit capabilities.

Re: Ask HN: How does your company manage its encryption keys?

#77

Post by up_and_up »

At my prev company we generated keys and split them using `ssss-split` and handed out shards to specific individuals via a keybase exploding message. Our system required at least 3 shards (combined via `ssss-combine`) to reboot.

FYI: Hashicorp vault just uses Shamir's Secret Sharing scheme under the hood: https://github.com/hashicorp/vault/blob/45b9f7c1a53506dc9722...

Re: Ask HN: How does your company manage its encryption keys?

#80

Post by rrdharan »

jwr wrote: post #51

Here's what works for small and medium organizations for data which needs to be encrypted at rest, but is not often accessed (so, backups): 1. Buy a bunch of Yubikeys, minimum of 2. 2. Create GPG keys and store them on YubiKeys. Follow this guide: https://github.com/drduh/YubiKey-Guide (if you want to, keep the secret keys, but in case of multiple YubiKeys I would not keep them anywhere). Remember to set the keys to…

This is all generally good advice, but I think there's huge potential complexity lurking here:

> 4. Take care of the physical keys with proper storage and procedures. Do not store the keys together, have at least one in a really secure location, check if you have all the keys regularly, etc.

Would be great to see what folks think this concretely looks like for joe random startup in Capital City, Somewhere.

e.g. Does "really secure" mean "find a bank that still offers safety deposit boxes"? Does it mean paying for something like Iron Mountain (http://ironmountain.com/) or one of its competitors?

Post reply on HN