Hacker News Reader

Comment by mihaaly | Hacker News Reader

Naive question: why would someone trust private keys and other secrets to a service provider?

Because you have no choice. Often times you run your backend on someone else's computer (the cloud) and they need the key(s) they need in order to access the other services your application needs to do its job.

I heard providers making private keys expecting it to be private, keeping it secret. But it is not, it is shared in fact. It sounds like violating the intended nature of keys. For convenience. Convenience of yet another service is much less important than security and har to imagine being a 'no choice' matter. It feels like some developers consciously but ignorantly and actively fuck up the product they make, risking their users, along their own convenience.

I'm not sure what you mean. If I have an app that sends emails (Sendgrid), maybe an SMS (Twilio), connects to a database (Planetscale), talks to some AI vendor (OpenAI) in the background and has a Stripe integration, I have no other option than to store the credentials for those services with my app at the cloud hoster of choice.

Well, OIDC Federation exists, but its still not widely available, and also requires a trustworthy party.

If there is no choice than exposing private keys that needs to be rotated in case of compromise then perhaps that is an incompetent design choice, isn't it? Co-locating services where available or limit from what location a key is accepted, why that is not an option? I still think that if there is 'no other choice than exposing secrets' then there is some seriously fundamental wrongdoing is involved there and there is no-one else to blame for the lots of fuck ups happening than those forming those services - who else, basically, right? the weather or some imaginary father-figure? - the way they do. Regardless if this is a widespread practice. Many wrong will not make something good. There is always a choice, like not doing what cannot be done right. Right?

We reached a state where whatever is on the web that cannot be trusted. Users worry, privacy and secrets are compromised on a huuuge scale, while the creators who did this way are saying 'this is normal business'. That's not right! Privacy is sacrificed for developer's convenience.

Genuine question: what do you recommend as an alternative?

The only alternative I can think of is "own and operate all of your site's hardware on physical premises to which you have sole access", and even that's not perfect.

Are you arguing against hosting/cloud/datacenter services in general? Or is there a specific technique you would prefer people use to secure their keys in a non-owned environment?

Reply on news.ycombinator.com