this post was submitted on 28 Nov 2023
740 points (99.3% liked)
196
16582 readers
2207 users here now
Be sure to follow the rule before you head out.
Rule: You must post before you leave.
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I once had to work with a government agency that insisted they generate and provide my private key.
At least they told you about the wire tap?
I'm migrating millons of encrypted credit cards from one platform to another (it's all in the same company, but different teams, different infra, etc).
I'm the one responsible for decrypting each card, preparing the data in a CSV, and encrypting that CSV for transit. Other guy is responsible for decrypting it, and loading it into the importer tool. The guy's technical lead wanted me to generate the pair of keys and send him the private key, since that way I didn't have to wait for the guy and "besides, it's all in the same company, we're like a family here".
Of course I didn't generate the key pair and told them that I didn't want to ever have access to the private key, but wow. That made me lose a lot of respect for that tech lead.
So you wanna be key buddies? Respectfully.
I know one municipal agency that does the same...