Ask HN: How do you ask customers for 'secrets' | Hacker News Reader

Ask HN: How do you ask customers for 'secrets'

4 pointschrisacky9 comments

We provide API integrations as a service to our customers. We'll frequently need things like a single API key, or a Client + Secret, or a BasicAuth + username/password, merchant vendor codes etc.

Once we get the passwords/keys/secrets, they are stored within a vault, but we don't have a good way of asking our customers for them to give them confidence on supplying.

Curious what solutions people have come up with?

ie. PGP email. (Might be difficult for non-technically inclined people to achieve). Sending half to "Skype" (or generic chat), the other to email/phone. This i'd argue is less secure but seen as more secure to the customer than just having a collection form to let them enter directly. PGP self-hosted form submission which encrypts before sending...

The things we want to avoid here is having passcodes all flying around on different medium, and have a single process which is both seen by the customer as secure and is actually secure. The problems I've has is we can make something that is secure, but customers think it's not because it's a simple 'web browser' that is being submitted. We also need a non-technical solution for when clients aren't too capable, if we set something up which isn't convenient, even the technical folk will look at circumventing.

1Password's guest mode is quite convenient and definitely provides a measure of confidence for the client. I use this with a number of clients and it works well for users of most technical levels.

Once they transfer a secret to us, I just move it out of the guest vault into another one. When I transfer a secret to them, I ask them to confirm that they have it and then I remove it from the shared vault.

I usually ask clients to send over sensitive passwords and keys via iMsg if possible.

If that's not possible I use

https://1time.app

It encrypts and gives you a cut and paste URL/pass to view, it also times out after a specified time.

and ask client to send user/password separately, and not to include any identifying information as to what service it's for.

Could this be used to share credit card details as well?

I think it would be better to share card details over a voice call or using stripe in a form.

Agreed, but some people just hate the phone. I'm looking for a modern looking form / way to collect this info in a trustworthy way.

Just have a form over HTTPS that store it somewhere in your Vault so that you can move it where appropriate later and add the instructions for power users that want to use PGP before sending it on the page.

It will be convenient and secure for everybody, and users wanting an extra level of security can use PGP.

A form on a webpage secured with HTTPS. If they have questions about security, answer them and add it to an FAQ. Anything with a middleman seems like just a bad idea.

may be worth looking into dedicated services like Yopass

Thanks for this. That's exactly what I've been looking for. My idea that I was going to implement was a basic form submission with a build in end-to-end PGP pre-encryption. The customer who is savvy enough can view the PGP keys, but can also submit via the browser. This handles a lot more of the quality of life processes/workflows behind single-use etc.

Reply on news.ycombinator.com