Show HN: Secs-man, a secrets manager you can (not) rely on | Hacker News Reader

Show HN: Secs-man, a secrets manager you can (not) rely on

github.com

31 pointsFran31421 comments

This is a tool to manage encrypted local backups of secrets. The core idea is that it aims to be usable without depending on it, meaning that even if the software disappeared from the face of Earth tomorrow, your data would still be recoverable.

It also integrates nicely with NixOS (which is what I use, though it does not require NixOS to be used).

I have summed up a bit of explanation and some answers to reasonable questions in a blog post: https://baldino.dev/blog/secs-man/

Open articleView on HN

This is an interesting motivation for the project... I kind of get it, but, have you looked at fnox[0][1]? Curious how you'd compare/contrast goals with that if so, I think I prefer that as its not coupled to a single encryption tool (age) but supports age as well as multiple cloud or local options behind one unified interface... I think it can even mix multiple stores together? but I may be missing something/didn't read thoroughly yet...maybe there's a reason fnox doesn't work as well with Nix? fnox was discussed here previously[2]

[0]https://github.com/jdx/mise/discussions/6779 [1]https://github.com/jdx/fnox [2]https://news.ycombinator.com/item?id=45722931

I didn't know about it existence, it looks like a nice project! Also, it would probably play nicely with Nix (by writing wrappers instead of symlinks)

However it doesn't fit quite the same niche that my tool does. If I understand it correctly (though I only read those two links) fnox is more about how to use the secrets, ie given an encrypted description of the secrets, how to make them accessible to programs (kind of like sops?)

With my tool, secrets on the device are in plaintex and simply accessed by path reference by the respective programs. The focus of secs-man is more on exporting, ensuring integrity, and importing (possibly to remote machines). All of this, while being manually recoverable even without the tool.

Still, interesting project! Might take inspiration from it for some features

It reads to me as "sex man" but aside from that, looks useful!

I have to assume that's intentional, lol

Yes, that was intentional. Originally it was just called "secrets-manager", I decided to shorten it only because it was (not really) too long to type, and a friend of mine had the realization that you can abbreviate it to something that sounds funny!

As pointed out by the other user, yes it is intentional, I always like a silly name

Also, thank you for the comment! I use it on a weekly basis and it has integrated very nicely with my setup

The name is great, we should bring whimsy back to software

How do I tell all my coworkers about "sex-man" during a company teams meeting?

You have the named displayed on your screen at the same time and you keep a straight face.

And in these neck of the woods man is a short for manual. Funny name.

When I was kid, I was playing Nintendo games with my cousin, and my very straight-laced Mormon mom kept calling for me to come upstairs for dinner. I kept replying, "Just a sec!" as we tried to finish the stage. After a few times through this loop, she yelled "NO MORE SECS!" It's been a running joke in my family ever since.

What advantages does this have compared to something like the .kdbx format invented by KeePass, which is open and implemented by many other open-source tools than KeePass itself?

Depends on your usecase. If I understand it correctly, KeePass is "just" a password manager, not meant to deploy files to a system.

So for example if you wanted to backup and later import/deploy your ssh key, you'd have to manually take the saved value from KeePass and paste it into a file in the correct location (I'm only assuming tho, I don't use KeePass)

My tool is intended more for deploying files to a system where they can be used by various programs. This is closer to something like sops/sops-nix.

I guess that my wording "secrets" might be ambiguous on this. It's not meant to be a password manager or work as one. It's meant to be a tool for backing up and deploying SSH keys, wireguard keys, and so on

So is this like a encrypt tool where we pass an external key to encrypt and we can use other apps to decrypt since key is not embedded in the tool? Or am I understanding it wrong?

That is true, but it's not specifically what makes it unique. Most encryption tool (like https://github.com/FiloSottile/age which is what secs-man uses under the hood) do not usually bake in the encryption key, rather they expect you to generate it and provide it.

This is true for secs-man too: when you export it prompts with "Enter passphrase:" and you enter the passphrase (I am considering extending it to read the passphrase from a file or from an environment variable, or piped in from stdin, but I'm still not sure what to think of if from a security standing point and I they don't fit my current use so I don't have it in the current TODO)

What makes it unique is that it can be completely emulated by hand (even though it might be a bit tedious) from just a terminal with bash and age installed. This is explained a bit better in the blog post or in the "philosophy section" of the README, but the main point is that (in my opinion) you should NEVER find yourself vendor-locked-in for any data, in particular for secrets. However, you will always need tools for managing them. My tool is designed to be usable and avoid vendor-lock-in, meaning that even if you lose access to the tool you are not locked out of your tools!

I have probably phrased it better in the linked blog post, I invite you to read it if you're still curious. I'm here for any other question!

Sincerely, I don't get the motivation for this. It feels like `age` is pulling most of the work I care about. `age` is the only tool here encrypting and decrypting secrets, are you managing the orchestration of secrets with your tool?

age is pulling all the encryption work. What the tool does is the import/export managing.

First of all, it creates snapshots for each export and it ensures to pull the latest snapshot during import. Also, it manages the hashes of the secrets (created on first export) and of the export, which ensure that the files are not corrupted, so that when I import I can be sure that no bitrot happened and the secrets that get copied on my machine are bit-identical to the ones I exported.

That being said, it's true that this is not a lot of work to be pulling. As I wrote in the blog post, this Rust tool could have been a Bash script. However I opted for not-bash because I don't feel particularly comfortable with bash and I like to have types. If I knew Go, it would have been a solid option

This project is screaming for a pronunciation guide.

If you're confident that Linux machines aren't going anywhere, the pass utility is a nice option.

I confused your username with jeanp413

By the looks of it, someone way more skilled than me!

Reply on news.ycombinator.com