4 ms·

How is this tool different to Hashicorp's Vault? Also, if I'm using "Enterprise Self Hosted", which means I am doing the hosting myself - am I not responsible

by zmxz 5y ago

How is this tool different to Hashicorp's Vault? Also, if I'm using "Enterprise Self Hosted", which means I am doing the hosting myself - am I not responsible for all the protection features you outlined there? If it's on my hardware, I'm doing the backups, patches, DDOS protection and so on? I'm sorry if I sound blunt, but the pricing page looks like you tried to enlist as many buzzwords as possible to sound relevant. Auto-cluster mode sounds like PM2 cluster mode (PM2 being the supervisor tool). There's many oddities in the pricing page, I won't list them all but I think you can see why I'm skeptic about your software. Vault does a great job dealing with secrets and is less ambiguous about what or how it does it.

danenania 5y ago
Thanks for your feedback. Enterprise Self-Hosted runs in an AWS account that you control. It uses AWS Aurora and Fargate, along with a handful of other AWS supporting services. Auto-scaling, high availability, a private network, backups, patches, and DDOS protection are all built-in. The goal is to make running self-hosted, production-ready EnvKey as easy and hands-off as possible. All the details on setup, deployment, and management are here: https://docs-v2.envkey.com/docs/enterprise-self-hosted https://docs-v2.envkey.com/docs/enterprise-self-hosted The main differences with Vault are EnvKey's client-side end-to-end encryption, which doesn't trust the host API server under any circumstances, much simpler integration, much easier setup/maintenance for self-hosting (takes about an hour for a scalable, production-ready cluster), and many developer productivity features around managing environments, avoiding duplication, handling environment updates, access control, and a lot more. All that said, I take your points and we will try to improve our pricing page.
- 998wwwww 5y ago
  Why does client side encryption matter? explain it like I'm 5 please
  - danenania 5y ago
    If the host server is compromised, attackers still will not be able to access secrets. Vault attempts to mitigate this with its 'seal' functionality, but in practice if an attacker gains access to a running Vault server, and/or the cloud provider account it's running in, there are many ways that secrets could be exposed. EnvKey allows you to avoid trusting the host server, full stop.
    - zmxz 5y ago
      If cloud account is compromised, there are far worse implications that just being ble to access Vault's secrets and no, it's not true that there are "many" ways secrects could be exposed. That's precisely what Vault protects against.
      - danenania 5y ago
        Vault attempts to protect against host compromise scenarios, but it's a very hard problem. Ultimately, in order to do anything useful, Vault deals with plaintext values in memory, and that means that yes, there are ways for an attacker to get access. Here's a good example: https://github.com/slingamn/vault-exfiltrate https://github.com/slingamn/vault-exfiltrate The Vault docs include a list of 'hardening' steps for secure production usage. These are great steps to take, but each one represents a mistake that could be made. And because the Vault process is trusted with plaintext secrets, the stakes are high. Making a mistake could lead to a compromise. With EnvKey, the host server is never sent secrets in plaintext. For defense in depth, we also follow best practices for hardening our networks. But I think we've seen with Okta and other incidents that despite best intentions, best efforts, and strong engineering, trusting the host server whatsoever just isn't good enough anymore.
    - gclawes 5y ago
      In this regard envkey is much like 1password or lastpass, the server never knows the contents of your vault.

by zmxz 5y ago

danenania 5y ago

Thanks for your feedback. Enterprise Self-Hosted runs in an AWS account that you control. It uses AWS Aurora and Fargate, along with a handful of other AWS supporting services. Auto-scaling, high availability, a private network, backups, patches, and DDOS protection are all built-in. The goal is to make running self-hosted, production-ready EnvKey as easy and hands-off as possible. All the details on setup, deployment, and management are here: https://docs-v2.envkey.com/docs/enterprise-self-hosted https://docs-v2.envkey.com/docs/enterprise-self-hosted The main differences with Vault are EnvKey's client-side end-to-end encryption, which doesn't trust the host API server under any circumstances, much simpler integration, much easier setup/maintenance for self-hosting (takes about an hour for a scalable, production-ready cluster), and many developer productivity features around managing environments, avoiding duplication, handling environment updates, access control, and a lot more. All that said, I take your points and we will try to improve our pricing page.

998wwwww 5y ago
Why does client side encryption matter? explain it like I'm 5 please
- danenania 5y ago
  If the host server is compromised, attackers still will not be able to access secrets. Vault attempts to mitigate this with its 'seal' functionality, but in practice if an attacker gains access to a running Vault server, and/or the cloud provider account it's running in, there are many ways that secrets could be exposed. EnvKey allows you to avoid trusting the host server, full stop.
  - zmxz 5y ago
    If cloud account is compromised, there are far worse implications that just being ble to access Vault's secrets and no, it's not true that there are "many" ways secrects could be exposed. That's precisely what Vault protects against.
    - danenania 5y ago
      Vault attempts to protect against host compromise scenarios, but it's a very hard problem. Ultimately, in order to do anything useful, Vault deals with plaintext values in memory, and that means that yes, there are ways for an attacker to get access. Here's a good example: https://github.com/slingamn/vault-exfiltrate https://github.com/slingamn/vault-exfiltrate The Vault docs include a list of 'hardening' steps for secure production usage. These are great steps to take, but each one represents a mistake that could be made. And because the Vault process is trusted with plaintext secrets, the stakes are high. Making a mistake could lead to a compromise. With EnvKey, the host server is never sent secrets in plaintext. For defense in depth, we also follow best practices for hardening our networks. But I think we've seen with Okta and other incidents that despite best intentions, best efforts, and strong engineering, trusting the host server whatsoever just isn't good enough anymore.
  - gclawes 5y ago
    In this regard envkey is much like 1password or lastpass, the server never knows the contents of your vault.