4 ms·

Hey HN, I built EnvKey to simplify the process of securely managing API keys, credentials, and configuration. It provides you with a convenient, end-to-end en

Hey HN, I built EnvKey to simplify the process of securely managing API keys, credentials, and configuration. It provides you with a convenient, end-to-end encrypted ui for managing user access levels and multiple server environments in one place, and makes integration as easy as an environment variable (ENVKEY=p9WYzzHefy33gzgDdvPJ-EKdh4jgBsRBBNerK ) and a line or two of code. The goal is to help your team avoid sharing sensitive config over Slack, email, or other insecure channels. Its OpenPGP-based encryption ensures that no third party (including EnvKey itself) ever has access to your secrets. It would be great to get your feedback, and I'd be happy to answer any questions here!

bmh_ca 9y ago
There is definitely a value for this. A useful integration for some would be using the hardware security/key modules in Amazon, Google, Microsoft, etc.
- danenania 9y ago
  Yep, integration with key modules is definitely on the roadmap.
hdhzy 9y ago
Sound cool. Could you give a high level view on how does this exactly work? (I've skimmed the page) I assume the ENVKEY is some sort of ID or part of OpenPGP decryption key. Where does the actual config come from? Is it stored in encrypted form in some kind of shared service?
- danenania 9y ago
  Sure. EnvKey is essentially a thick convenience/signature verification/web of trust layer on top of OpenPGP. Every user and every ENVKEY (which gives access to either a local dev machine or a server) represents an OpenPGP keypair. As you add/edit config, an encrypted copy is created for each public key that has access to that environment. The config itself is stored encrypted in EnvKey's servers, and is also backed up to S3 (in a separate region) on every update. An ENVKEY is one part lookup id and one part OpenPGP passphrase. For example in this one: ENVKEY=QD8zrywsAccdUhLKSqAx-36MWK4hmY8sd9Siw QD8zrywsAccdUhLKSqAx is the lookup id, and 36MWK4hmY8sd9Siw is the passphrase. You can see what a raw server response looks like here: http://env.envkey.com/v1/QD8zrywsAccdUhLKSqAx http://env.envkey.com/v1/QD8zrywsAccdUhLKSqAx It contains the encrypted config, the ENVKEY's associated public key, a private key encrypted with a 16-char alphanumeric passphrase (the second portion of the ENVKEY), trusted public keys that were stored and signed by the private key when the ENVKEY was generated, the public key of the last user to update the associated config, and a chain of signed public keys that allows the client libraries to verify that updater's public key back to an initially trusted public key. For more nitty gritty details on encryption and security, you can read more here: https://security.envkey.com https://security.envkey.com
  - hdhzy 9y ago
    Excellent summary. Thanks a lot!
gldalmaso 9y ago
I'm gonna throw a use case here in case it makes sense to you or other folks. We currently have some duplicated secrets in keepass and on Jenkins credentials that are needed in CI environments. If EnvKey could accept a KeePass import and have a Jenkins plugin, it would definitely be something to consider.
- danenania 9y ago
  Having lots of duplicated ENV vars in CI, and consequently seeing builds fail again and again when they'd get out of sync is part of the frustration that inspired me to build EnvKey. I don't think there should be special integration required to use it with any CI platform, including Jenkins... as long as there's a place to set environment variables, you just need to set a single ENVKEY there, and from that point, your CI server will stay automatically in sync. I will look into the possibility of a KeePass import. Currently, you can import config as key-value pairs to speed up integration with an existing project, so if you can get your KeePass data into this format: KEY1=val1 KEY2=val2 etc. you could already import and start using EnvKey without much fuss.
koolba 9y ago
How do you inject that master key into the running app?
- danenania 9y ago
  Either a gitignored .env file in development (EnvKey wraps the dotenv lib to pull this in) or an environment variable on a server.

bmh_ca 9y ago

There is definitely a value for this. A useful integration for some would be using the hardware security/key modules in Amazon, Google, Microsoft, etc.

danenania 9y ago
Yep, integration with key modules is definitely on the roadmap.

hdhzy 9y ago

Sound cool. Could you give a high level view on how does this exactly work? (I've skimmed the page) I assume the ENVKEY is some sort of ID or part of OpenPGP decryption key. Where does the actual config come from? Is it stored in encrypted form in some kind of shared service?

danenania 9y ago
Sure. EnvKey is essentially a thick convenience/signature verification/web of trust layer on top of OpenPGP. Every user and every ENVKEY (which gives access to either a local dev machine or a server) represents an OpenPGP keypair. As you add/edit config, an encrypted copy is created for each public key that has access to that environment. The config itself is stored encrypted in EnvKey's servers, and is also backed up to S3 (in a separate region) on every update. An ENVKEY is one part lookup id and one part OpenPGP passphrase. For example in this one: ENVKEY=QD8zrywsAccdUhLKSqAx-36MWK4hmY8sd9Siw QD8zrywsAccdUhLKSqAx is the lookup id, and 36MWK4hmY8sd9Siw is the passphrase. You can see what a raw server response looks like here: http://env.envkey.com/v1/QD8zrywsAccdUhLKSqAx http://env.envkey.com/v1/QD8zrywsAccdUhLKSqAx It contains the encrypted config, the ENVKEY's associated public key, a private key encrypted with a 16-char alphanumeric passphrase (the second portion of the ENVKEY), trusted public keys that were stored and signed by the private key when the ENVKEY was generated, the public key of the last user to update the associated config, and a chain of signed public keys that allows the client libraries to verify that updater's public key back to an initially trusted public key. For more nitty gritty details on encryption and security, you can read more here: https://security.envkey.com https://security.envkey.com
- hdhzy 9y ago
  Excellent summary. Thanks a lot!

gldalmaso 9y ago

I'm gonna throw a use case here in case it makes sense to you or other folks. We currently have some duplicated secrets in keepass and on Jenkins credentials that are needed in CI environments. If EnvKey could accept a KeePass import and have a Jenkins plugin, it would definitely be something to consider.

danenania 9y ago
Having lots of duplicated ENV vars in CI, and consequently seeing builds fail again and again when they'd get out of sync is part of the frustration that inspired me to build EnvKey. I don't think there should be special integration required to use it with any CI platform, including Jenkins... as long as there's a place to set environment variables, you just need to set a single ENVKEY there, and from that point, your CI server will stay automatically in sync. I will look into the possibility of a KeePass import. Currently, you can import config as key-value pairs to speed up integration with an existing project, so if you can get your KeePass data into this format: KEY1=val1 KEY2=val2 etc. you could already import and start using EnvKey without much fuss.

koolba 9y ago

How do you inject that master key into the running app?

danenania 9y ago
Either a gitignored .env file in development (EnvKey wraps the dotenv lib to pull this in) or an environment variable on a server.