Hacker News Reader

secret encryption is always a bit of a conundrum for a running cloud system. the secret needs to be plaintext when you use it, so you have to decrypt at least on every deploy. but that means the keys have to be ready at hand, no passphrase, somewhere an automated system can get them. that makes it very hard to actually protect them from someone with full access

Easy, all the bad guys need to do is access whatever system stores the decryption keys.

They absolutely are. Every ceo sees security as a massive money pit (it is) but there’s a reason it’s expensive and hard to do well. Those compliance frameworks they show off are meaningless and can be manipulated extremely easily. There are a lot of security leaders who are going to be having a very bad time soon.