EnvKey
Infrastructure
secrets management
SHOW HN2017
116points
50comments
#372of 2,242 in 2017
Top 17%of 2017 by points
How HN took it
MixedNo clear lean
5 positive, 9 neutral or asking, 1 mixed, 11 critical, out of 26 comments about the project. Thread score -0.17.
Idea: 3 for, 9 againstDocs: 2 for, 0 againstDesign: 0 for, 1 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Simple integration via a single environment variable
From 2 comments
This seems like the classic "OSS is free if you value your time at zero" answer, but I don't think it is wrong. I think this is the type of tool which I model you as having…
patio11 on HNEnvKey's main focus is on convenience and speed of integration. - As a hosted service, it offers a ~5-10 minute integration workflow, and doesn't require setting up/maintaining…
danenania on HN
End-to-end encryption and open-source clients
From 2 comments
The short/salty answer: EnvKey's app and client libraries are end-to-end encrypted and open source so that you don't have to trust our servers with your data. The longer answer:…
danenania on HNAs a side note, while EnvKey's server is not open source, the app and client libraries are all MIT-licensed, and they are designed specifically not to trust the server.
danenania on HN
Objections
Trusting a closed-source hosted server with secrets
From 3 comments
Who runs envkey? Or better phrased, what social proof do you have which might make a user feel safe about handing you their data?
josegonzalez on HNI personally like the idea and will try it out for my private projects but this would probably not be possible to be used by the company I work for because we'd give everything…
rukenshia on HNSince this is what basically every secret-sharing system purports to do, and the major ones are all FOSS, I'm curious if you could tell me why someone would pay for a new…
tptacek on HN
Storing an env key still leaves the identity problem unsolved
From 1 comment
Sorry. I'm really not sold that this is suitable for applications to use. The core problem to secrets management is service identity. Managing encrypted data is not hard, it's…
ejcx on HN
Environment variables are a risky place for secrets
From 1 comment
am i the only one who finds it ironic (edit: stupid) that you're advocating storing secrets in an environment variable?…
kcmastrpc on HN
Why pay when FOSS secret managers exist
From 2 comments
Since this is what basically every secret-sharing system purports to do, and the major ones are all FOSS, I'm curious if you could tell me why someone would pay for a new…
tptacek on HNLet me ask a question that is closer to the spirit of what I meant before: Given that there are already carefully tested FOSS secret sharing systems, why should some other…
tptacek on HN
Requests
Self-hosted version
From 1 comment
I personally like the idea and will try it out for my private projects but this would probably not be possible to be used by the company I work for because we'd give everything…
rukenshia on HN
KeePass import and Jenkins plugin
From 1 comment
I'm gonna throw a use case here in case it makes sense to you or other folks. We currently have some duplicated secrets in keepass and on Jenkins credentials that are needed in…
gldalmaso on HN
Hardware security module integration
From 1 comment
There is definitely a value for this. A useful integration for some would be using the hardware security/key modules in Amazon, Google, Microsoft, etc.
bmh_ca on HN
Python wrapper
From 1 comment
This looks great - are you currently working on a python wrapper? If not, I'd be happy to help out there.
goodoldboys on HN
Questions
How does the encryption and key handling work
From 2 comments
Sound cool. Could you give a high level view on how does this exactly work? (I've skimmed the page) I assume the ENVKEY is some sort of ID or part of OpenPGP decryption key.…
hdhzy on HNHow do you inject that master key into the running app?
koolba on HN
Who runs the company and can users trust it
From 1 comment
Who runs envkey? Or better phrased, what social proof do you have which might make a user feel safe about handing you their data?
josegonzalez on HN
Alternatives named
HashiCorp Vault
From 2 comments
* AWS has one built in KMS along with EC2 Parameter Store. * Vault(http://vaultproject.io/) * Keywhiz (https://square.github.io/keywhiz/) * Blackbox…
zie on HNHow is this different from Vault?
sdotsen on HN
AWS Parameter Store with KMS
From 1 comment
If you're on AWS, a good solution is EC2 Parameter Store. Paired with KMS, you have encrypted secrets, locked down by IAM user if necessary. Paired with IAM Roles, you don't even…
bdcravens on HN
Keywhiz
From 1 comment
* AWS has one built in KMS along with EC2 Parameter Store. * Vault(http://vaultproject.io/) * Keywhiz (https://square.github.io/keywhiz/) * Blackbox…
zie on HN
Blackbox
From 1 comment
* AWS has one built in KMS along with EC2 Parameter Store. * Vault(http://vaultproject.io/) * Keywhiz (https://square.github.io/keywhiz/) * Blackbox…
zie on HN