IssueRaiser

There are many solutions out there that attempt to solve the secrets distribution problem.

There are many solutions out there that attempt to solve the secrets distribution problem. Vault is the newest one. None of them solve the fundamental problem of the secret zero: provisioning the first secret on an untrusted system the automated way is hard, and without that secret zero, there is no way to authenticate the new system. With Vault, you still need to figure out how to push secret zero (here a client authentication token). If you can solve that, why not push the secret you need to push directly, and bypass Vault entirely?

Posted by jvehent on Apr 28, 2015, 5:45 PM

Tags

Related issues

Raise real-world problems, find people facing the same issue, and discuss solutions.7,000 issues0 comments

hackernews (Other)

There are many solutions out there that attempt to solve the secrets distribution problem.

jvehentApr 28, 2015, 5:45 PM

There are many solutions out there that attempt to solve the secrets distribution problem. Vault is the newest one. None of them solve the fundamental problem of the secret zero: provisioning the first secret on an untrusted system the automated way is hard, and without that secret zero, there is no way to authenticate the new system. With Vault, you still need to figure out how to push secret zero (here a client authentication token). If you can solve that, why not push the secret you need to push directly, and bypass Vault entirely?

Comments (0)

No comments yet. Start the discussion.

Comment on this issue