3 ms·

Show HN: Open-Source Data Security Platform

2 points by freeqaz 5y ago

freeqaz 5y ago
Author here. Feel free to ask me any questions. This is a project I've been working on full-time with 2 other SWEs for about a year. We originally stumbled into this with some Security Consulting work that we did for some startups. We realized that the Data Security space was quite lacking when it came time for companies to start bolting on "Compliance" to their existing software, and that's why we built LunaSec. It's basically a toolkit that's designed to prevent various security vulnerabilities from having negative impact by preventing any security vulnerabilities from actually leak sensitive data. It's a lot to explain here, and we've better documented it in our docs on Security[0] and our Threat Modelling for each vuln. The core of the tech is built around encrypting data one-way and using an identifier to access records again later (called Tokenization). We then we use that to gate access to data by adding short-lived authorization "grants" to de-tokenize data, we add drop-in replacements for common form elements like <input> elements but that work via iframes, and we have a way to automatically "migrate" functions into a Lambda where they have restricted network permissions (in POC form). The closest alternatives to this functionality are all Enterprise, proprietary software (such as VeryGoodSecurity). Nobody is really taking the approach we are though in terms of end-to-end security. We've got some big goals and it's going to take a lot of time to get to all of them. If you have a minute to check out our demo app[1] and try this out, that would be very much appreciated! I personally wanted to not just try to build yet-another-SaaS and, instead, go the Open Source route. We just finished making this all Open Source and easily demo-able, which took a few months alone, so I'm sure there will be some bugs and rough edges to get started with this. This is the first time we're posting about this publicly as an Open Source project, instead of just something we set up for companies directly (we were in private beta for a while). Please share any thoughts that you have. Thank you! 0: https://www.lunasec.io/docs/pages/overview/security/vulns-and-mitigations/ https://www.lunasec.io/docs/pages/overview/security/vulns-an... 1: https://www.lunasec.io/docs/pages/overview/demo-app/overview/ https://www.lunasec.io/docs/pages/overview/demo-app/overview...

2 points by freeqaz 5y ago

Author here. Feel free to ask me any questions. This is a project I've been working on full-time with 2 other SWEs for about a year. We originally stumbled into this with some Security Consulting work that we did for some startups. We realized that the Data Security space was quite lacking when it came time for companies to start bolting on "Compliance" to their existing software, and that's why we built LunaSec. It's basically a toolkit that's designed to prevent various security vulnerabilities from having negative impact by preventing any security vulnerabilities from actually leak sensitive data. It's a lot to explain here, and we've better documented it in our docs on Security[0] and our Threat Modelling for each vuln. The core of the tech is built around encrypting data one-way and using an identifier to access records again later (called Tokenization). We then we use that to gate access to data by adding short-lived authorization "grants" to de-tokenize data, we add drop-in replacements for common form elements like <input> elements but that work via iframes, and we have a way to automatically "migrate" functions into a Lambda where they have restricted network permissions (in POC form). The closest alternatives to this functionality are all Enterprise, proprietary software (such as VeryGoodSecurity). Nobody is really taking the approach we are though in terms of end-to-end security. We've got some big goals and it's going to take a lot of time to get to all of them. If you have a minute to check out our demo app[1] and try this out, that would be very much appreciated! I personally wanted to not just try to build yet-another-SaaS and, instead, go the Open Source route. We just finished making this all Open Source and easily demo-able, which took a few months alone, so I'm sure there will be some bugs and rough edges to get started with this. This is the first time we're posting about this publicly as an Open Source project, instead of just something we set up for companies directly (we were in private beta for a while). Please share any thoughts that you have. Thank you! 0: https://www.lunasec.io/docs/pages/overview/security/vulns-and-mitigations/ https://www.lunasec.io/docs/pages/overview/security/vulns-an... 1: https://www.lunasec.io/docs/pages/overview/demo-app/overview/ https://www.lunasec.io/docs/pages/overview/demo-app/overview...