Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Supabase Vault is now in Beta

supabase.com

Post reply on HN
Print view View original

1–10 of 29 posts

Re: Supabase Vault is now in Beta

#2

Post by swyx »

> Some of the possibilities we are looking into are: End-to-end encryption, Group encryption, Public Key Management

super exciting stuff. you are making security more accessible for a generation of apps which is no small feat.

Re: Supabase Vault is now in Beta

#4

Post by kiwicopple »

hey hn, supabase ceo here

Vault is a Postgres extension that wraps pgsodium/libsodium. It enables 2 key features:

1. Secrets management - you can store things like API Keys

2. Transparent Column Encryption (TCE)[0]. This allows you to encrypt a column in any of your tables, with a View for "selecting" out the decrypted data. It enables "row level encryption" too when you create a key for each row.

The blog post details how it works with AEAD[1]. This is a secure way of encrypting "associated data". An easy way to explain this:

Imagine you associated a `user_id` with a `credit_card_number` while you encrypt it. A bad-actor updates the `user_id` to their own ID. When they attempt to decrypt the `credit_card_number` it will fail because the data that is associated is different. (note: please don't store credit cards in supabase)

We're rolling it progressively to the platform over the next month. Michel, the mastermind behind this one will be here to answer the questions that are above my head.

this is the last big launch of the week. You can see everything we launched this week here[2]. Some highlights from today: pg_graphql v1.0[3] (re-written in rust), PostgREST 11[4], and PGroonga release for multilingual search.

[0] TCE: https://supabase.com/blog/transparent-column-encryption-with...

[1] AEAD: https://en.wikipedia.org/wiki/Authenticated_encryption#Authe...

[2] Launch Week: https://supabase.com/blog/launch-week-6-wrap-up

[3]: pg_graphql v1.0: https://supabase.com/blog/postgres-point-in-time-recovery

[4]: PostgREST 11: https://supabase.com/blog/postgrest-11-prerelease

Re: Supabase Vault is now in Beta

#6

Post by kiwicopple »

swyx wrote: post #2

> Some of the possibilities we are looking into are: End-to-end encryption, Group encryption, Public Key Management super exciting stuff. you are making security more accessible for a generation of apps which is no small feat.

hopefully soon we're able to integrate Vault + Auth, which will make it easier for developers to make e2e encryption a default for user data.

Re: Supabase Vault is now in Beta

#8

Post by michelpp »

Vault and pgsodium dev here at supabase, we're pretty excited about the Vault, and this is just the beginning of some of the advanced encryption functions that libsodium provides that we want to bring into the Postgres ecosystem.

Happy to answer any questions here about how the Vault works now, and always excited to see use cases and suggestions for features from the community. libsodium is a big API, and pgsodium exposes most of it (about 110 functions so far, a few functions don't make sense in SQL) so there is a lot of possibilities for new ideas and projects straight into SQL without having to learn the low level C details of using the sodium library directly.

Re: Supabase Vault is now in Beta

#9

Post by moralestapia »

>Group encryption: [...]

Came here to ask just about that but I see it's on your roadmap already, that's good and godspeed with that since encryption is hard.

During my PhD, I worked a little while with threshold encryption schemes (sometimes called horcrux encryption schemes, i.e. make n keys, you need at least m of them to perform some operations) (ref. my noob-ish question here ha https://crypto.stackexchange.com/questions/74763/is-there-an...).

I created a small system that allowed one to reconstruct parametric data from 3D shapes, but if and only if you had at least n pieces of the whole model, because reasons.

Reading this announcement, I recalled several things that came up during my research, which apply to this context as well.

* How can one make sure that losing one key is not the end of the db (i.e. backup keys)?

* How to share db access but not individual keys? (i.e. one key per user BUT all of them can read)

* What if encryption is shared by n users but one of them loses their key?

* How many keys for encrypting (or just one?), how many of them for decrypting?

* Represent all of this in some sort of stateful model, after all it's a db (in my case it was files), it's meant to be cold storage, everything should to be able to be reconstructed/recovered from there.

The list goes on and on ...

Anyway, just wanted to say that this is a very interesting and promising feature to be found in a database. Great work, I'm eagerly waiting to get my hands on this.

Re: Supabase Vault is now in Beta

#10

Post by kiwicopple »

thedangler wrote: post #7

IS Vault their own extension? I'm using Postgresql for a service and I'd love to use this feature. Maybe I should just use supabase as my backend... "I'm going to have to rethink my ink"

yes - it's open source here: https://github.com/supabase/vault

This wraps pgsodium (https://github.com/michelp/pgsodium), which wraps libsodium (https://doc.libsodium.org/).

> I'm using Postgresql for a service and I'd love to use this feature. Maybe I should just use supabase as my backend...

We'll try to get the other big clouds to adopt some of these extensions we're developing (including pg_graphql). Vault is still in beta, but once it's stable I think it's a no-brainer for them. it can work with secure-enclaves, so it ties in nicely with their other offerings (read: more economically interesting for them). That said, we'd love for you to try supabase.

Post reply on HN