4 ms·

Why does client side encryption matter? explain it like I'm 5 please

• danenania 5y ago
  If the host server is compromised, attackers still will not be able to access secrets. Vault attempts to mitigate this with its 'seal' functionality, but in practice if an attacker gains access to a running Vault server, and/or the cloud provider account it's running in, there are many ways that secrets could be exposed. EnvKey allows you to avoid trusting the host server, full stop.
  • zmxz 5y ago
    If cloud account is compromised, there are far worse implications that just being ble to access Vault's secrets and no, it's not true that there are "many" ways secrects could be exposed. That's precisely what Vault protects against.
    • danenania 5y ago
      Vault attempts to protect against host compromise scenarios, but it's a very hard problem. Ultimately, in order to do anything useful, Vault deals with plaintext values in memory, and that means that yes, there are ways for an attacker to get access. Here's a good example: https://github.com/slingamn/vault-exfiltrate https://github.com/slingamn/vault-exfiltrate The Vault docs include a list of 'hardening' steps for secure production usage. These are great steps to take, but each one represents a mistake that could be made. And because the Vault process is trusted with plaintext secrets, the stakes are high. Making a mistake could lead to a compromise. With EnvKey, the host server is never sent secrets in plaintext. For defense in depth, we also follow best practices for hardening our networks. But I think we've seen with Okta and other incidents that despite best intentions, best efforts, and strong engineering, trusting the host server whatsoever just isn't good enough anymore.
  • gclawes 5y ago
    In this regard envkey is much like 1password or lastpass, the server never knows the contents of your vault.