[{"data":1,"prerenderedAt":389},["ShallowReactive",2],{"project-15330757":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":46,"post_text":47,"what":48,"said":106,"maker_in_thread":231,"shape":239,"grid":244,"attempts":350,"same_week":351,"maker_shows":31,"maker_hidden":381,"reader_version":382,"card":383},"15330757","EnvKey","securely manage API keys, credentials, and config","title","Show HN: EnvKey – securely manage API keys, credentials, and config","https:\u002F\u002Fwww.envkey.com","envkey.com","danenania",1506349641,2017,116,50,372,2242,17,"notable","infrastructure","secrets management","web_app",[21,24,25,26,27],"api keys","environment variables","openpgp","config management","mixed",-0.171,{"positive":31,"neutral":32,"mixed":33,"critical":34},5,9,1,11,26,{"idea":37,"design":39,"docs":41,"execution":43,"privacy":44,"performance":45},{"positive":38,"critical":32},3,{"positive":40,"critical":33},0,{"positive":42,"critical":40},2,{"positive":40,"critical":33},{"positive":40,"critical":40},{"positive":40,"critical":40},[40,31,40,38,31,38,40,38,33,38,40,40,33,33,33,33,40,40,40,38,33,40,40,38,33,40,33,40,31,40,31,33,40,33,40,38,38,38,40,38],null,{"problem":49,"audience":59,"pricing":47,"motivation":66,"time_to_build":47,"stack":73,"openness":103,"stage":104,"team_size":105},{"value":50,"source":51,"evidence":52},"Teams share API keys and config insecurely over Slack, email and git","maker",[53,56],{"id":54,"by":11,"text":55},"15330956","Hey HN, I built EnvKey to simplify the process of securely managing API keys, credentials, and configuration. It provides you with a convenient, end-to-end encrypted ui for…",{"id":57,"by":11,"text":58},"15334487","EnvKey's main focus is on convenience and speed of integration. - As a hosted service, it offers a ~5-10 minute integration workflow, and doesn't require setting up\u002Fmaintaining…",{"value":60,"source":51,"evidence":61},"Development teams and companies managing app secrets and config",[62,63],{"id":57,"by":11,"text":58},{"id":64,"by":11,"text":65},"15334004","No problem, I'm happy to address concerns. You're right that the ENVKEY still needs to be protected. There is no getting around the need store and protect some sort of key. You…",{"value":67,"source":51,"evidence":68},"Frustration with duplicated env vars in CI going out of sync and insecure secret sharing",[69,72],{"id":70,"by":11,"text":71},"15333128","Having lots of duplicated ENV vars in CI, and consequently seeing builds fail again and again when they'd get out of sync is part of the frustration that inspired me to build…",{"id":64,"by":11,"text":65},[74,80,88,97],{"value":75,"source":51,"evidence":76},"Go (core OpenPGP library)",[77],{"id":78,"by":11,"text":79},"15334507","All the clients (including the app) are fully open-source. Both the npm package and the ruby gem wrap a lower-level library that is written in Go -…",{"value":81,"source":51,"evidence":82},"Ruby and Node.js client libraries",[83,87],{"id":84,"by":85,"text":86},"15334446","koolba","In the same vein, why should the client be closed sourced at all? I skimmed through the source of the npm package and see that it's a shim for a binary blob for each target…",{"id":78,"by":11,"text":79},{"value":89,"source":51,"evidence":90},"Kubernetes",[91,94],{"id":92,"by":11,"text":93},"15332718","Yes, that's understandable. To be clear, all config is end-to-end encrypted, so EnvKey's servers cannot see any configuration in plaintext. The native app and the client…",{"id":95,"by":11,"text":96},"15332674","Yes, it's been through a several-month beta period and is now production ready. It's running a high availability, multi-az Kubernetes architecture, and encrypted config is also…",{"value":98,"source":51,"evidence":99},"AWS S3 backups",[100],{"id":101,"by":11,"text":102},"15333005","Sure. EnvKey is essentially a thick convenience\u002Fsignature verification\u002Fweb of trust layer on top of OpenPGP. Every user and every ENVKEY (which gives access to either a local dev…","unknown","launched","company",{"praise":107,"objections":126,"requests":163,"questions":189,"alternatives":204},[108,117],{"value":109,"source":110,"evidence":111},"Simple integration via a single environment variable","commenter",[112,116],{"id":113,"by":114,"text":115},"15336658","patio11","This seems like the classic \"OSS is free if you value your time at zero\" answer, but I don't think it is wrong. I think this is the type of tool which I model you as having…",{"id":57,"by":11,"text":58},{"value":118,"source":51,"evidence":119},"End-to-end encryption and open-source clients",[120,123],{"id":121,"by":11,"text":122},"15333609","The short\u002Fsalty answer: EnvKey's app and client libraries are end-to-end encrypted and open source so that you don't have to trust our servers with your data. The longer answer:…",{"id":124,"by":11,"text":125},"15334625","As a side note, while EnvKey's server is not open source, the app and client libraries are all MIT-licensed, and they are designed specifically not to trust the server.",[127,142,149,156],{"value":128,"source":110,"evidence":129},"Trusting a closed-source hosted server with secrets",[130,134,138],{"id":131,"by":132,"text":133},"15333364","josegonzalez","Who runs envkey? Or better phrased, what social proof do you have which might make a user feel safe about handing you their data?",{"id":135,"by":136,"text":137},"15332669","rukenshia","I personally like the idea and will try it out for my private projects but this would probably not be possible to be used by the company I work for because we'd give everything…",{"id":139,"by":140,"text":141},"15334345","tptacek","Since this is what basically every secret-sharing system purports to do, and the major ones are all FOSS, I'm curious if you could tell me why someone would pay for a new…",{"value":143,"source":110,"evidence":144},"Storing an env key still leaves the identity problem unsolved",[145],{"id":146,"by":147,"text":148},"15333890","ejcx","Sorry. I'm really not sold that this is suitable for applications to use. The core problem to secrets management is service identity. Managing encrypted data is not hard, it's…",{"value":150,"source":110,"evidence":151},"Environment variables are a risky place for secrets",[152],{"id":153,"by":154,"text":155},"15335470","kcmastrpc","am i the only one who finds it ironic (edit: stupid) that you're advocating storing secrets in an environment variable?…",{"value":157,"source":110,"evidence":158},"Why pay when FOSS secret managers exist",[159,160],{"id":139,"by":140,"text":141},{"id":161,"by":140,"text":162},"15338912","Let me ask a question that is closer to the spirit of what I meant before: Given that there are already carefully tested FOSS secret sharing systems, why should some other…",[164,168,175,182],{"value":165,"source":110,"evidence":166},"Self-hosted version",[167],{"id":135,"by":136,"text":137},{"value":169,"source":110,"evidence":170},"KeePass import and Jenkins plugin",[171],{"id":172,"by":173,"text":174},"15333001","gldalmaso","I'm gonna throw a use case here in case it makes sense to you or other folks. We currently have some duplicated secrets in keepass and on Jenkins credentials that are needed in…",{"value":176,"source":110,"evidence":177},"Hardware security module integration",[178],{"id":179,"by":180,"text":181},"15332517","bmh_ca","There is definitely a value for this. A useful integration for some would be using the hardware security\u002Fkey modules in Amazon, Google, Microsoft, etc.",{"value":183,"source":110,"evidence":184},"Python wrapper",[185],{"id":186,"by":187,"text":188},"15336192","goodoldboys","This looks great - are you currently working on a python wrapper? If not, I'd be happy to help out there.",[190,200],{"value":191,"source":110,"evidence":192},"How does the encryption and key handling work",[193,197],{"id":194,"by":195,"text":196},"15332749","hdhzy","Sound cool. Could you give a high level view on how does this exactly work? (I've skimmed the page) I assume the ENVKEY is some sort of ID or part of OpenPGP decryption key.…",{"id":198,"by":85,"text":199},"15334385","How do you inject that master key into the running app?",{"value":201,"source":110,"evidence":202},"Who runs the company and can users trust it",[203],{"id":131,"by":132,"text":133},[205,216,223,227],{"value":206,"source":110,"evidence":207},"HashiCorp Vault",[208,212],{"id":209,"by":210,"text":211},"15335747","zie","* AWS has one built in KMS along with EC2 Parameter Store. * Vault(http:\u002F\u002Fvaultproject.io\u002F) * Keywhiz (https:\u002F\u002Fsquare.github.io\u002Fkeywhiz\u002F) * Blackbox…",{"id":213,"by":214,"text":215},"15333910","sdotsen","How is this different from Vault?",{"value":217,"source":110,"evidence":218},"AWS Parameter Store with KMS",[219],{"id":220,"by":221,"text":222},"15334162","bdcravens","If you're on AWS, a good solution is EC2 Parameter Store. Paired with KMS, you have encrypted secrets, locked down by IAM user if necessary. Paired with IAM Roles, you don't even…",{"value":224,"source":110,"evidence":225},"Keywhiz",[226],{"id":209,"by":210,"text":211},{"value":228,"source":110,"evidence":229},"Blackbox",[230],{"id":209,"by":210,"text":211},{"comments":232,"answered":34,"key":233},19,[234,235,238],{"id":54,"text":55},{"id":236,"text":237},"15332737","Yep, integration with key modules is definitely on the roadmap.",{"id":101,"text":102},{"commenters":240,"max_depth":241,"maker_replies":232,"first_comment_mins":242,"lifespan_hours":243},23,4,18,38,[245,247,249,251,253,254,257,258,259,261,263,265,268,272,274,276,279,282,283,285,287,288,290,294,295,296,297,299,302,304,306,307,308,310,312,315,317,319,323,325,328,329,332,334,338,340,342,344,346,348],[54,40,40,246,11,33],"project\u002Fneutral\u002Fidea",[179,40,31,248,180,40],"project\u002Fpositive\u002Fidea",[236,40,40,250,11,33],"maker\u002Fneutral\u002Fnone",[194,40,38,252,195,40],"project\u002Fneutral\u002Fdesign",[101,40,40,252,11,33],[255,40,31,256,195,40],"15333581","maker\u002Fpositive\u002Fdocs",[172,40,38,246,173,40],[70,40,40,248,11,33],[198,40,38,260,85,40],"project\u002Fneutral\u002Fdocs",[262,40,40,260,11,33],"15334579",[220,33,33,264,221,40],"project\u002Fcritical\u002Fidea",[266,33,38,260,267,40],"15334647","cyberferret",[269,33,40,270,271,40],"15334696","other\u002Fneutral\u002Fnone","tfjaeckel",[273,33,40,270,221,40],"15335086",[275,33,40,270,147,40],"15335207",[277,33,33,264,278,40],"15334957","nsfmc",[280,33,33,264,281,40],"15336354","ejholmes",[139,42,33,264,140,40],[84,42,33,284,85,40],"project\u002Fcritical\u002Fexecution",[78,42,40,286,11,33],"project\u002Fneutral\u002Fnone",[57,42,40,246,11,33],[124,42,40,289,11,33],"project\u002Fpositive\u002Fprivacy",[291,42,40,292,293,40],"15334706","commenter\u002Fneutral\u002Fnone","chicago_wade",[209,42,33,264,210,40],[113,42,31,248,114,40],[161,42,33,264,140,40],[298,42,40,246,11,33],"15344880",[300,42,40,301,11,33],"15344922","maker\u002Fpositive\u002Fnone",[131,38,38,303,132,40],"project\u002Fneutral\u002Fprivacy",[121,38,40,305,11,33],"maker\u002Fneutral\u002Fprivacy",[146,241,33,264,147,40],[64,241,40,246,11,33],[309,241,33,264,147,40],"15334058",[311,241,40,303,11,33],"15334183",[313,241,40,292,314,40],"15335245","xnxn",[186,31,31,316,187,40],"project\u002Fpositive\u002Fdocs",[318,31,40,250,11,33],"15344741",[320,321,31,248,322,40],"15330874",6,"lprubin",[324,321,33,264,136,40],"15332632",[135,326,38,327,136,40],7,"project\u002Fmixed\u002Fprivacy",[92,326,40,303,11,33],[153,330,33,331,154,40],8,"project\u002Fcritical\u002Fdesign",[333,330,40,303,11,33],"15344801",[335,32,38,336,337,40],"15332564","project\u002Fneutral\u002Fperformance","methyl",[95,32,40,339,11,33],"project\u002Fpositive\u002Fperformance",[341,32,38,252,337,40],"15333246",[343,32,38,252,322,40],"15333395",[345,32,40,303,11,33],"15333440",[213,347,38,246,214,40],10,[349,347,40,246,11,33],"15334075",[],[352,357,362,367,372,376],{"id":353,"name":354,"points":355,"category":356},"15330409","Logo Crunch",328,"creative",{"id":358,"name":359,"points":360,"category":361},"15346381","Moocha.io",231,"learning_science",{"id":363,"name":364,"points":365,"category":366},"15337342","Reddit Grid",217,"consumer_social",{"id":368,"name":369,"points":370,"category":371},"15321555","ThingsOnReddit",153,"web_saas",{"id":373,"name":374,"points":375,"category":356},"15302718","TR-101",105,{"id":377,"name":378,"points":379,"category":380},"15351778","Raspberry Pi Zero W Simultaneous AP and Managed (Client) Mode WiFi",101,"hardware",false,"v2",{"id":384,"name":5,"line":6,"ai":381,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":385,"top":18,"kw":386,"maker":11,"domain":10,"tier":19,"attempts":40,"strip":387,"url":9,"mix":388,"praise":109,"objection":128,"sub":21},15330757,-0.17,[21,24,25,26,27],"0503530313001111000310031010505101033303",[31,32,33,34],1794036559233]