Re:The "email is authentication" pattern
by tasuki on Sunday September 08, 2024 @12:23PM
(#41481282)
I don't. And frankly I don't think a safe is a good place to store secrets. It is too conspicuous.
[ Parent
| on HN ]
Re:The "email is authentication" pattern
by firesteelrain on Sunday September 08, 2024 @12:42PM
(#41481389)
These safes are certified for all kinds of sensitive (GSA recommends them for Classified use from what I have read) use and they are safe.
Ideally, you connect Vault to a HSM if you need that kind of security that’s being described. HSMs are electronic safes
Re:The "email is authentication" pattern
by tasuki on Sunday September 08, 2024 @01:03PM
(#41481532)
> These safes are certified for classified use and they are safe.
The website says "10 minutes against forced entry". That's not safe.
No safe is safe against a state level actor. No safe is safe against "hit you with a crowbar until you open the safe".
Whatever secrets you have, it's better to hide them than to put them in such a conspicuous place. The only reason one should use a safe is as a plausible decoy...
Re:The "email is authentication" pattern
by firesteelrain on Sunday September 08, 2024 @01:19PM
(#41481644)
This isn’t the safe to rule all safes. You have other mitigating factors like access control.
If you have state level actors physically breaking into your facilities then we might be at war
Re:The "email is authentication" pattern
by tasuki on Sunday September 08, 2024 @02:24PM
(#41482083)
If you have enough books (which doesn't even have to be that many), it's much better to store your secrets in one or more of the books.
Re:The "email is authentication" pattern
by firesteelrain on Sunday September 08, 2024 @04:19PM
(#41482878)
Yea but you have multiple pieces of the secret to restart your Vault instance. Now you need to go to everyone’s office or home to get this secret to restore it.
I am referring to Shamir algorithm that Vault uses