from Hacker News

Protecting infrastructure secrets with Keywhiz from Square

by strzalek on 4/14/15, 4:57 PM with 9 comments

• by joe9876123 on 4/20/15, 5:46 AM

  Hi, First of all looks like an amazing project so thanks! You mention key rotation but I think I might have misunderstood what you're talking about. Let's say I have a symmetric key and I want to change it, in a CD environment there is a short period where you need to support two keys. How does KeyWhiz fit in there? If it doesn't I'd really like to understand what you meant

• by ispivey on 4/14/15, 6:05 PM

  I'd love to hear from some of the team who built this about differences between Keywhiz and Keyczar, which to my mind was the best-practice open-source cross-platform solution to date (i.e. if you're not relying on things like AWS Cloudformation config or Heroku config vars to "manage" secrets).

  Obvious pieces to me appear to be (1) roles and auditability (2) end-user front-end (3) filesystem interface & associated ease of access for various services. But I'm not an expert!

• by christop on 4/14/15, 5:26 PM

  This is a good talk on (what I believe to be) this software: https://www.slideshare.net/diogomonica/bletchley