undefined | Better HN

0 pointstialaramex4y ago0 comments

But why are you "rotating" keys? Most of the reasons people give involve unnecessary exposure of the private key material, which is exactly what you're encouraging by having 1password keep these keys instead of them living on individual hardware.

0 comments

Yeri4y ago

Well keeps are also shared via chat or emails and people exit the company. Sure taking out one key is more precise but rotating all is probably easier

tialaramexOP4y ago

You may notice they aren't called "Fun size sharing keys" or "Family pack keys" but instead "Private keys" because of that word "Private".

You don't need to wait for people to "exit the company". Sharing private keys was wrong, invalidate those keys. If somebody else knows your private key it isn't private any more. Get this stuff right and rotating keys is unecessary, get it wrong and rotating keys can't help you.

j / k navigate · click thread line to collapse

0 pointstialaramex4y ago0 comments

0 comments

Yeri4y ago

Well keeps are also shared via chat or emails and people exit the company. Sure taking out one key is more precise but rotating all is probably easier

tialaramexOP4y ago

You may notice they aren't called "Fun size sharing keys" or "Family pack keys" but instead "Private keys" because of that word "Private".

j / k navigate · click thread line to collapse