3 ms·

How does getting permission make you “able” to read secrets? It seems like maybe you can read everyone’s secrets but you’re promising not to.

dangtony98 4y ago
This has to do with how our underlying cryptography works; it's end-to-end encrypted by default with opt-out ability for integrations that need it. You'd have to manually login to Infisical and grant that permission but the platform itself would be unable to read your secrets otherwise. Technical details: In Infisical, secrets are stored in vaults (we call them projects). They are encrypted symmetrically by vault keys for which there are multiple copies of vault keys encrypted under the public key of each vault member (your teammates). Vault members decrypt their copy of the vault key locally and use that to decrypt secrets (in browser or via CLI similar to platforms like 1Password and Bitwarden); this client-side decryption process makes it impossible for the platform itself to decrypt the secrets itself. What is meant by users having the ability to give permission to Infisical to access/read secrets is to share a copy of the vault key by encrypting it under one of the public keys of Infisical — we employ an abstract concept of "bots" that have public-private key pairs assigned to each vault. When you share a copy of the vault key with Infisical (which can't happen without your explicit action), it grants Infisical the ability to access your secrets for integrations like Vercel, Render, GitHub, etc.
- nonethewiser 4y ago
  Very well explained, thank you.
nicoburns 4y ago
Presumably the permissions switch is in the client rather than the server. It's true that you have to trust the client, but that's unavoidable.
- dangtony98 4y ago
  Yeah that's correct. The permissions switch can only be on the client because that's where sharing the vault key with Infisical by encrypting it under one of its public keys occurs.

dangtony98 4y ago

This has to do with how our underlying cryptography works; it's end-to-end encrypted by default with opt-out ability for integrations that need it. You'd have to manually login to Infisical and grant that permission but the platform itself would be unable to read your secrets otherwise. Technical details: In Infisical, secrets are stored in vaults (we call them projects). They are encrypted symmetrically by vault keys for which there are multiple copies of vault keys encrypted under the public key of each vault member (your teammates). Vault members decrypt their copy of the vault key locally and use that to decrypt secrets (in browser or via CLI similar to platforms like 1Password and Bitwarden); this client-side decryption process makes it impossible for the platform itself to decrypt the secrets itself. What is meant by users having the ability to give permission to Infisical to access/read secrets is to share a copy of the vault key by encrypting it under one of the public keys of Infisical — we employ an abstract concept of "bots" that have public-private key pairs assigned to each vault. When you share a copy of the vault key with Infisical (which can't happen without your explicit action), it grants Infisical the ability to access your secrets for integrations like Vercel, Render, GitHub, etc.

nonethewiser 4y ago
Very well explained, thank you.

nicoburns 4y ago

Presumably the permissions switch is in the client rather than the server. It's true that you have to trust the client, but that's unavoidable.

dangtony98 4y ago
Yeah that's correct. The permissions switch can only be on the client because that's where sharing the vault key with Infisical by encrypting it under one of its public keys occurs.