Hacker News Reader

Comment by danenania | Hacker News Reader

Hey HN,

I built EnvKey to simplify the process of securely managing API keys, credentials, and configuration.

It provides you with a convenient, end-to-end encrypted ui for managing user access levels and multiple server environments in one place, and makes integration as easy as an environment variable (ENVKEY=p9WYzzHefy33gzgDdvPJ-EKdh4jgBsRBBNerK ) and a line or two of code.

The goal is to help your team avoid sharing sensitive config over Slack, email, or other insecure channels. Its OpenPGP-based encryption ensures that no third party (including EnvKey itself) ever has access to your secrets.

It would be great to get your feedback, and I'd be happy to answer any questions here!

View on HN

There is definitely a value for this.

A useful integration for some would be using the hardware security/key modules in Amazon, Google, Microsoft, etc.

Yep, integration with key modules is definitely on the roadmap.

I'm gonna throw a use case here in case it makes sense to you or other folks.

We currently have some duplicated secrets in keepass and on Jenkins credentials that are needed in CI environments.

If EnvKey could accept a KeePass import and have a Jenkins plugin, it would definitely be something to consider.

Having lots of duplicated ENV vars in CI, and consequently seeing builds fail again and again when they'd get out of sync is part of the frustration that inspired me to build EnvKey.

I don't think there should be special integration required to use it with any CI platform, including Jenkins... as long as there's a place to set environment variables, you just need to set a single ENVKEY there, and from that point, your CI server will stay automatically in sync.

I will look into the possibility of a KeePass import. Currently, you can import config as key-value pairs to speed up integration with an existing project, so if you can get your KeePass data into this format:

KEY1=val1 KEY2=val2

etc. you could already import and start using EnvKey without much fuss.

Sound cool. Could you give a high level view on how does this exactly work? (I've skimmed the page)

I assume the ENVKEY is some sort of ID or part of OpenPGP decryption key. Where does the actual config come from? Is it stored in encrypted form in some kind of shared service?

Sure.

EnvKey is essentially a thick convenience/signature verification/web of trust layer on top of OpenPGP. Every user and every ENVKEY (which gives access to either a local dev machine or a server) represents an OpenPGP keypair. As you add/edit config, an encrypted copy is created for each public key that has access to that environment.

The config itself is stored encrypted in EnvKey's servers, and is also backed up to S3 (in a separate region) on every update.

An ENVKEY is one part lookup id and one part OpenPGP passphrase. For example in this one: ENVKEY=QD8zrywsAccdUhLKSqAx-36MWK4hmY8sd9Siw

QD8zrywsAccdUhLKSqAx is the lookup id, and 36MWK4hmY8sd9Siw is the passphrase.

You can see what a raw server response looks like here: http://env.envkey.com/v1/QD8zrywsAccdUhLKSqAx It contains the encrypted config, the ENVKEY's associated public key, a private key encrypted with a 16-char alphanumeric passphrase (the second portion of the ENVKEY), trusted public keys that were stored and signed by the private key when the ENVKEY was generated, the public key of the last user to update the associated config, and a chain of signed public keys that allows the client libraries to verify that updater's public key back to an initially trusted public key.

For more nitty gritty details on encryption and security, you can read more here: https://security.envkey.com

Excellent summary. Thanks a lot!

How do you inject that master key into the running app?

Either a gitignored .env file in development (EnvKey wraps the dotenv lib to pull this in) or an environment variable on a server.

Reply on news.ycombinator.com