🚀 Feature: ephemeral private key (do not store private key on disk) #131

New Issue

AtHeartEngineer · 2025-07-08T08:40:39-04:00

AtHeartEngineer commented

2025-07-08 08:40:39 -04:00

Originally created by @ItalyPaleAle on 5/28/2025

Feature description

Instead of saving the private key to disk, Pocket ID could optionally generate a key when it starts up and keep it in-memory only. This would be optional.

Pros:

Private keys are never stored un-encrypted on disk (see also #580)
The key is rotated frequently, every time Pocket ID starts up

Cons:

The key changes every time Pocket ID is started, which means that tokens issued by Pocket ID would be invalidated on every restart. This may or may not be acceptable depending on what the downstream clients expect. This is why this feature is optional.

Pitch

This is another relatively simple feature to implement that helps protecting the "keys to the kingdom". It may not be suitable for all scenarios, but many users who run Pocket ID in their homelab would likely have minimal to no impact when using this.

*Originally created by @ItalyPaleAle on 5/28/2025* ### Feature description Instead of saving the private key to disk, Pocket ID could optionally generate a key when it starts up and keep it in-memory only. This would be **optional**. Pros: - Private keys are never stored un-encrypted on disk (see also #580) - The key is rotated frequently, every time Pocket ID starts up Cons: - The key changes every time Pocket ID is started, which means that tokens issued by Pocket ID would be invalidated on every restart. This _may or may not_ be acceptable depending on what the downstream clients expect. This is why this feature is optional. ### Pitch This is another relatively simple feature to implement that helps protecting the "keys to the kingdom". It may not be suitable for _all_ scenarios, but many users who run Pocket ID in their homelab would likely have minimal to no impact when using this.

AtHeartEngineer closed this issue

2025-07-08 08:40:39 -04:00

AtHeartEngineer added the feature feature feature feature feature feature feature feature feature feature feature feature feature feature feature feature labels 2025-07-08 08:40:40 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pocket-id#131