Ask HN: How does your company manage its encryption keys?
Hi, this issue brought me back in the days when i was just a IT handyman in a small company.
The priority of that company was to don't share keys or everything related to them with no one.
For no one i mean, third-parties software of wherever a password or an encryption would be watched to someone.
At the time, i thought this "obsession" was clearly a sign of mental illness, cause the company was very small and we were in the nowhere of nothing.(maybe nowdays i still think it).
Our method was based on a selfmade MD5 encryption script using ruby on rails.
Put your password into it, it print it on a datacoin blockchain that generates a univocal MD5 hash.
This hash goes around 5 (later 6) local server those collect the encrypted key.
Obviously these servers were without an internet connection, running only for internal company purposes.(such as this).
For sure a weakness of this procedure was the slowness for obtain a new password or to change it.
I think that the most secure place is where there'snt an internet connection.
Thanks for bring back memories :D