2 ms·
You're just moving the problem around... Access isn't "cut off" by revoking an env key. The actual secret has not changed. I think, just like vault, this is mi
by ejcx 9y ago
You're just moving the problem around... Access isn't "cut off" by revoking an env key. The actual secret has not changed.
I think, just like vault, this is missing the point wrt secrets management for services. Sorry to be the negative nancy but this is something I've spent a lot of time on and feel pretty strongly about.
- danenania 9y agoI see your point, but using EnvKey also removes storing plain text copies of secrets as a default step in the workflow, so after you revoke an ENVKEY, it's a lot less likely that copies are still floating around. Of course, in the event that you're worried about this, you still need to assume that copies could have been made, so you still have to rotate any secrets that could have been exposed. EnvKey makes that process a LOT faster as well, and speed can be crucial in the case of a compromise. In short, while EnvKey doesn't solve every conceivable issue with managing secrets securely, and still requires some common sense, I think it does offer a drastically better default workflow for companies that are currently sharing secrets on email or slack, keeping them in git, etc.
- xnxn 9y ago> just like vault As a happy Vault user I'm curious about your thoughts here.