Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 80 posts

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#71

Post by javaunsafe2019 »

llamaLord wrote: post #59
javaunsafe2019 wrote: post #56

Idk as you loose the index and several operators your database might get useless and this solution would not scale well. From my experience you better have dedicated views for different stakeholders and your problem is solved without those downsides.

I think you're looking at this from the wrong level. This product kinda assumes that field level encryption is desired for certain protected fields and works from there. That may not be a correct assumption for ALL systems, but it's a safe assumption for A LOT of systems. OP this is seriously cool, nicely done.

Maybe you did not get my point of a dedicated view/interface/bucket …

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#72

Post by ianpurton »

So I've seen something like this before i.e. https://github.com/cossacklabs/acra

So for me everything has to be infrastructures as code. I don't want to log into a UI and start configuring connections etc.

Also not keen on giving you production accesses to my databases, but maybe I misunderstood your implementation.

So I like the idea of a docker container that does this as a proxy.

It's a tough market you're going into, $395 per database is a big ask.

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#73

Post by debussyman »

ianpurton wrote: post #72

So I've seen something like this before i.e. https://github.com/cossacklabs/acra So for me everything has to be infrastructures as code. I don't want to log into a UI and start configuring connections etc. Also not keen on giving you production accesses to my databases, but maybe I misunderstood your implementation. So I like the idea of a docker container that does this as a proxy. It's a tough market you're going i…

Acra does offer similar functionality to JumpWire!

We don't have production access to your databases, it's a pretty fundamental part of our value prop. Database credentials can be stored in your own secret store (i.e. HashiCorp Vault) and is loaded directly from there by the proxy. And if you are concerned about the UI harvesting credentials as they are being entered, you can self-host the web app as well for full isolation.

We are also expanding our IaC support, many of the configurations in our product can be defined as YAML in a git repository with webhooks. For deployment, we provide helm charts [1] and terraform modules [2] to include in your existing ci/cd pipeline.

[1] https://charts.jumpwire.ai [2] https://github.com/jumpwire-ai/infrastructure-tools/tree/mai...

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#74

Post by atonse »

hexedpackets wrote: post #64
atonse wrote: post #63

Do you guys post any details about the storage format? Like if I had the encryption key and any salt etc, can I decrypt it without your product? Also how much has the encrypted format been vetted? I saw your example and the last name seemed to be massive even compared to using something like KMS.

We still need to add the format to our docs, but it's essentially: prefix + base64(len_encode(metadata) + len_encode(key_tag) + aes_encrypt(data)) So definitely possible to decrypt it without JumpWire, if you have the keys. There are some pieces of metadata we add in that we could make optional if you want to reduce the resulting ciphertext size. That metadata adds a few extra bytes, but it doesn't grow with the data…

Thank you – I would recommend writing up a page with all the details on your docs because that would appease a whole lot of people that would be your target customer (like myself)

Although I might be biased cuz I'm a founder from a tech background so I want those details, but even with those details, I'm one of your target market but my worry with these kinds of products tends to be more about things like:

- am I adding an unreliable piece of infra to my stack? this is going to be a critical gatekeeper, so if this fails, not only is it like my DB being down, as the only method of decrypting my data, does it have the ability to fail in a way that results in permanent data loss (whereby I can't decrypt some subset of the data)

- if I had to yank this out, what's the process? will I be stuck?

- what are the chances of us doing something stupid and lock OURSELVES out of our own data? what guardrails are available there?

- what is the key management story? (which answers a lot of the above questions)

- is this roll-your-own crypto (not just which algorithm, but how the messages are constructed, etc) or something standard and vetted? Because there's no secret sauce to be had there, it's more in making all those OTHER elements easier for me.

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#75

Post by juliennakache »

I liked very much the idea of dynamic masking. However, I wonder how good it works in practice. I was actually assessing one of your competitor (www.satoricyber.com) and found an easy to workaround the masking - I was able to essentially access any mask data using not-so-advanced SQL functions. Do you guys have a publicly available test suite against your proxy that people and security researcher can review? Also, do you have a bug bounty program and / or a clear disclosure policy when a vulnerability is found?

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#76

Post by debussyman »

juliennakache wrote: post #75

I liked very much the idea of dynamic masking. However, I wonder how good it works in practice. I was actually assessing one of your competitor (www.satoricyber.com) and found an easy to workaround the masking - I was able to essentially access any mask data using not-so-advanced SQL functions. Do you guys have a publicly available test suite against your proxy that people and security researcher can review? Also, do…

Interesting to hear your work on Satori, thanks for sharing! Curious if you've done the same analysis for Immuta?

We haven't set up a public test suite or bug bounty program yet, but will look into this, it makes a lot of sense.

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#77

Post by angryasian »

hexedpackets wrote: post #34
angryasian wrote: post #26

I've worked with systems like this in the past. It becomes a huge burden eventually when you have teams like marketing, analytics, etc that need access to the raw data and you eventually have to store all this stuff somewhere else unencrypted.

Yeah, the mix of permissions can definitely be a big pain. We're building with that in mind - policy exceptions can be set so that specific groups of applications get the raw data when querying. All of the policies stack too; one common setup is to encrypt by default, then allow some specific tool to get raw data but audit the queries it's doing.

I guess but yeah usually the hot databases will be encrypted. When moving to the data lake / warehouse its all unencrypted. I think it really comes down to What kind of data you're working with.

Last Password was hacked twice this year. How many data breaches are there on a regular basis. The reality is the cost of trouble worth the possibility. As much as everyone wants to say they care about users data, the reality in most companies is very different.

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#78

Post by wdb »

angryasian wrote: post #26

I've worked with systems like this in the past. It becomes a huge burden eventually when you have teams like marketing, analytics, etc that need access to the raw data and you eventually have to store all this stuff somewhere else unencrypted.

But is marketing and analytics even allowed to use PII if the user didn’t give explicit consent for such usage? Would be cool if such a system could have checks for these things

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#79

Post by lorrit »

hexedpackets wrote: post #16
spak9 wrote: post #13

FYI, I think there may be a typo on your ` https://jumpwire.ai/pricing ` page on the `How are keys handled?` ``` How are keys handled? We generate unqique encryption keys for every account and store them in a secure secrets manager. Subkeys are routinely created and rotated from the master key. For additional security, we support user provided keys on our Team and Enterprise plan. ``` `unqique` --> `unique`

Thanks for letting us know, should be fixed in a minute!

Another typo on the main page: "quickly secure your most valuable asset - you’re data." -> "your data"

Looks like a great product!

Re: Launch HN: JumpWire (YC W22) – Easily encrypt customer data in your databases

#80

Post by danbmil99 »

debussyman wrote: post #53
danbmil99 wrote: post #52

Earlier quoted context omitted.

15 yrs experience with Mongo - if you want some help (contract work) please contact me dan.miller at eye0.com

Thanks, I'll reach out next week!

Looks like this is what you need:

https://www.mongodb.com/docs/manual/core/queryable-encryptio...

Post reply on HN