Hacker News Reader

Comment by js4ever | Hacker News Reader

I wonder how large is the submarket of developers aware of the need to encrypt data ... And also OK to bring a third party like evervault into the deal.

View on HN

Hi! Founder of Evervault here.

You're totally right in saying the number of developers who are actively integrating encryption is pretty small as of today. What we're trying to do is improve developer experience to a point where encrypting all sensitive data is a no-brainer. Still early days here, but we're expending a lot of energy to make this happen.

Re: third-party dependency — we think the same way at Evervault. We bring third-party vendors into the mix if we think they can build something better than we could do ourselves, which is why we partnered with AWS on their Nitro Enclaves[0] product. Our root of trust is the AWS Nitro System. For customers who still aren't comfortable with us managing their security posture, we also offer on-prem and in-VPC options.

[0]: https://evervault.com/blog/e3

Really appreciate the plain "how it works" section just below the fold on the homepage. So many security products offer fluffy marketing pages — it's clear what this does from an implementation perspective right away.

Yeah I would definitely be wary about this. A self-hosted option, even if not open sourced, seems like a no-brainer to me. Nothing wrong with providing it as a SaaS as well.

Also being in the EU the first thing I look at is where the company is based and/or where they host my data, but I've trawled through this site and cannot seem to find a company address anywhere or details of their hosting setup? Nor is there a single "Security" page which outlines their credentials and security measures. I feel like these are critically important for a business like this which needs to build trust with potential customers.

The website design looks superb though and the product is definitely interesting.

EDIT: Ah noticed on the jobs page that they're in Ireland, but looks like their app front-end is hosted on Vercel and (per below) backend on AWS.

EDIT: And further confusion from the "Evervault Inc" in the footer and "Evervault Ltd" on Privacy Policy page. I'm not clear if this is an Irish company (and therefore covered by EU law) or a US company? These details are important for potential European customers.

They use AWS and their security enclaves called Nitro [0][1]

[0] https://aws.amazon.com/ec2/nitro/

[1] https://evervault.com/blog/e3

Thanks! Well I did ask for detail and [1] certainly delivers that...!

Definitely still needs an exec summary "Security" page though with a callout to relevant blog articles if necessary.

This is a great suggestion, thank you! We'll get to work creating this.

Was thinking the same thing, there's a reason encryption and auth software is open source and run internally (like hashicorps Vault).

Is it easier to use than setting up a Vault cluster? Yes, without a doubt, so for building new things as a single developer, it definitely has a market.

It would be more difficult on larger businesses though, since they have internal processes & certifications, that now need to rely on a 3rd party.

Perhaps it's not as small as you think. It all depends on who is the adversary in your threat model.

If you have applications that run in the field, and need to perform computation on data you don't want to be seized if the adversary gets hold of the device itself (state or private agents), then this may be a relatively low cost way to address this concern.

If you search for a solution for all possible threat models, well homomorphic encryption would all the boxes except it's too slow for doing anything practical with it.

If someone has access to the physical device, that device need to be able to display the actual data = the device has the "secret" information already.

if you need to output the secret, then you have no use for offloading computation on encrypted data.

There are scenarios where you can compute on encrypted data and produce a result that doesn't leak the entire data.

That is a use case, sure, but this service doesn’t provide computations, only management of keys.

I don't know; I just read what's written on their home page:

    Evervault Cages
    Process the data you encrypt with Relay or our SDK by deploying your code in Cages — isolated serverless functions hosted on Evervault.

    Cages automatically decrypt your data in an isolated environment, so you can still process data without handling it in plaintext.

perhaps I misunderstood what that feature is; if that's true I suspect it's not entirely my fault, but there is something misleading in the product description.

No, you're right, I missed that feature.

> There are scenarios where you can compute on encrypted data and produce a result that doesn't leak the entire data.

I believe what you're referring to is homomorphic encryption.

Yes I did mention that technique in my comment upthread. But there is a more simple stupid way: just perform the computation somewhere else, on some server you own, one some server you rent, on some service you rent... From the POV of the device in the field it doesn't really matter.

> I wonder how large is the submarket...

   large enough to warrant a crypto-currency: https://build.scrt.network/

By that definition, everything is a trillion dollar market. :)

I am founder & CEO of Skyflow PII data privacy vault. We are vaguely similar but our product line is focused on offering "PII database as a service" - and not really relays and cages. Happy to answer any questions.

To answer your question: "market for encrypting data" is infinite but in reality that's not really a market since encryption is a concept and not really a product.

The markets that do exist are: * GDPR & CCPA compliance (think OneTrust) * Data Residency (think Cloudflare) * Data Security as a Service (think Okta/Auth0) * Customer Data Management (think CRM)

Reply on news.ycombinator.com