Hacker News Reader

Comment by saurik | Hacker News Reader

That works fine as long as you don't care that advances in computers and cryptography would one day (maybe after you are dead, and likely only with some notable effort) allow someone to read your data and (much more practically) you are extremely confident you can't lose control of your key somehow.

View on HN

This is if you are storing all your data together in a single location. If you decouple it, using multiple accounts on the host, or even several hosts, you might have some of your data decrypted, but it would be worthless. If you decouple correctly, you should have data that is meaningless without some other data that is hosted elsewhere, on an account completely unrelated and unconnected to your other host accounts.

Managing and using private keys safely is still a huge unsolved problem in general.

Keychains, Vault, GPG, HSMs, password managers. It's solved, just requires effort and understanding to setup. It's neither "huge" nor "unsolved" as pks have to live somewhere and cannot exist in the aether.

Yeah, I meant that the security tradeoff with usability is unsolved in personal use. It requires too much effort and understanding. If you use hardware keys, you still have to backup your keys somewhere safely.

If it wasn't considered a solved problem, we wouldn't have public CA's for our browsers to trust, as their very premise is based on having a secure way to store private keys. I think a FIPS-140-2 level 4 HSM and hashicorp vault enterprise will cover 99.9999% of all other use cases for private CA's and PKI.

Security is solved in these use cases, but not usability while maintaining security for personal use.

It's funny that you mention the breaking of keys using outdated algorithms; I booted up my Standard Notes app and there's an "Encryption Upgrade Available" notice at the bottom which has you enter your password to locally regenerate your keys. I could imagine something similar working here, and perhaps let your progeny have access to your credentials postmortem.

Reply on news.ycombinator.com