It's worth it. And yes, I have done that, it's not a mystery, they all provide a API/ABI for interacting with them[1], such as OpenSSL's Engine API or PCKS#11.
Edit: There's even a project to literally do this directly from PHP[3]
[1] http://stackoverflow.com/questions/10796485/interfacing-with...
[2] http://en.wikipedia.org/wiki/PKCS_11
[3] http://stackoverflow.com/questions/3231293/how-to-interface-...
Eh, I had a Luna CA3 sitting on my desk for a while. HSMs aren't that exotic. I'd be more concerned about the HA aspects which could require extra code. I suppose you could just shove a USB HSM in several of your servers and encrypt every password with at least 2 of them.
Christ you weren't kidding about it being expensive. Amazons Cloud HSM is $5k upfront and $1.8/h thereafter, which is completely infeasible for the agencies I've worked at. A shame, I'd love to do the right thing there :(
That's why AWS also started offering Key Management Service: https://aws.amazon.com/kms/
You don't get your own HSM but it's MUCH cheaper ($1/key/month) and more scalable and available than an HSM.
That's brilliant. I'm definitely going to use that, thanks for posting it!
Re:Slack was hacked
by Zombieball on Friday March 27, 2015 @08:12PM
(#9279869)
I think AWS provides both key management services as well as cloud hsm.
I have not used either myself, but I would imagine the documentation is quite good.
Re:Slack was hacked
by ShaneWilton on Saturday March 28, 2015 @12:40AM
(#9280538)
I've done it using a $100 Cryptostick (Now Nitrokey). Here's a guide from Mozilla: https://blog.mozilla.org/security/2013/02/13/using-cryptosti...
And, no, I am not being facetious by saying nobody knows how to do that. I am being quite literal. Have you ever done that? Do you know how? Do you even know what you would google to figure out how?
I'm yet to see my favorite library of course's documentation on a HSM. How do you do that in e.g. PHP with MySQL? MVC with MS SQL? Java with Oracle?