🚀 Feature: Encrypt private key saved to DB #132

New Issue

AtHeartEngineer · 2025-07-08T08:40:40-04:00

AtHeartEngineer commented

2025-07-08 08:40:40 -04:00

Originally created by @ItalyPaleAle on 5/28/2025

Feature description

The private key is currently stored on disk un-encrypted. Anyone with access to the file system can get the "keys to the kingdom".

The private key could optionally be encrypted when stored to disk. The decryption key is provided to Pocket ID via env vars (e.g. ENCRYPTION_KEY) or with the name of another file containing the key (ENCRYPTION_KEY_FILE).

This allows also using a command to retrieve the key encryption key, e.g. to fetch it from a vault of some sort.

Pitch

Data stored on disk is not always safe and can be leaked or stolen by malicious code. Encrypting the private key is a simple and effective way to keep the "keys to the kingdom" safe.

*Originally created by @ItalyPaleAle on 5/28/2025* ### Feature description The private key is currently stored on disk un-encrypted. Anyone with access to the file system can get the "keys to the kingdom". The private key could optionally be encrypted when stored to disk. The decryption key is provided to Pocket ID via env vars (e.g. `ENCRYPTION_KEY`) or with the name of another file containing the key (`ENCRYPTION_KEY_FILE`). This allows also using a command to retrieve the key encryption key, e.g. to fetch it from a vault of some sort. ### Pitch Data stored on disk is not always safe and can be leaked or stolen by malicious code. Encrypting the private key is a simple and effective way to keep the "keys to the kingdom" safe.

AtHeartEngineer closed this issue

2025-07-08 08:40:40 -04:00

AtHeartEngineer added the feature feature feature feature feature feature feature feature feature feature feature feature feature feature feature feature feature labels 2025-07-08 08:40:41 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pocket-id#132