3 ms·
Yes, but this doesn't lock people out of decrypting old copies, it's git, they can rolllback to before their key was removed, and decrypt every old secret they
by sig-io 5y ago
Yes, but this doesn't lock people out of decrypting old copies, it's git, they can rolllback to before their key was removed, and decrypt every old secret they had access tobwhich hasn't been rotated yet.
The key-rotation on every employee-change is the hard part.
- Xylakant 5y agoYou have to assume in any case and for any password manager that they retain a decrypted copy - worst case manually copying the secret to a text file.