Cryptic
Security and privacy
secret management
SHOW HN2016
93points
32comments
#410of 2,264 in 2016
Top 19%of 2016 by points
How HN took it
MixedNo clear lean
0 positive, 6 neutral or asking, 2 mixed, 6 critical, out of 14 comments about the project. Thread score -0.31.
Privacy: 0 for, 4 againstIdea: 0 for, 1 againstDocs: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Neat idea and reasonable as a project
From 1 comment
So this is a neat idea, because Credstash and Sneaker are certainly not perfect gizmos, but it leads to the turtles problem: how do I securely handle the initial key that's being…
eropple on HN
Objections
Uses passwords as keys without a KDF
From 2 comments
This is exactly the use case of https://github.com/gtank/cryptopasta Although, the only thing I can see it doing wrong is the use of passwords as keys…
FiloSottile on HNA secure storage system shouldn't allow passwords as keys. If passwords are a thing that is going to happen, the API should be structured so that those passwords get run through…
tptacek on HN
Lacks KMS encryption context and IAM policy management that Credstash offers
From 2 comments
So this is a neat idea, because Credstash and Sneaker are certainly not perfect gizmos, but it leads to the turtles problem: how do I securely handle the initial key that's being…
eropple on HNCredstash looks great, but having written something very similar for internal use (a secrets management system using KMS and S3 for use by EC2 instances) I was expecting it to…
ak217 on HN
Vault already covers this need
From 1 comment
It's always good to see options out there. But honestly, having being working with Hashicorp's Vault for a while (https://www.vaultproject.io/) I really don't see the need for…
Natales on HN
Requests
Support KMS encryption context
From 1 comment
So this is a neat idea, because Credstash and Sneaker are certainly not perfect gizmos, but it leads to the turtles problem: how do I securely handle the initial key that's being…
eropple on HN
Document the crypto design
From 1 comment
Cool! I've love to hear more about the security and crypto design. I started writing up some questions but after asking so many it feels like I should just check out the code and…
ketralnis on HN
Questions
How does it compare to Vault?
From 1 comment
I don't know much about secret management. How does this compare to something like Vault? Edit: https://www.vaultproject.io/
RussianCow on HN
Can it replace 1Password?
From 1 comment
Can this be used to replace apps like 1Password for a skilled user?
pibefision on HN
Alternatives named
Credstash
From 1 comment
So this is a neat idea, because Credstash and Sneaker are certainly not perfect gizmos, but it leads to the turtles problem: how do I securely handle the initial key that's being…
eropple on HN
Vault
From 2 comments
I don't know much about secret management. How does this compare to something like Vault? Edit: https://www.vaultproject.io/
RussianCow on HNIt's always good to see options out there. But honestly, having being working with Hashicorp's Vault for a while (https://www.vaultproject.io/) I really don't see the need for…
Natales on HN
Sneaker
From 1 comment
So this is a neat idea, because Credstash and Sneaker are certainly not perfect gizmos, but it leads to the turtles problem: how do I securely handle the initial key that's being…
eropple on HN
Keywhiz
From 1 comment
It's always good to see options out there. But honestly, having being working with Hashicorp's Vault for a while (https://www.vaultproject.io/) I really don't see the need for…
Natales on HN
biscuit
From 1 comment
I went with biscuit because it writes to a simple file and I am not worried about updating 2 secrets at once, particularly since I have a different file per app per environment.…
gregwebs on HN