system
Given the following post, respond as if you're commenting on Reddit:
human
Where should you store your encryption information ? I.. dont seem to get it.

Greetings,

While working on a personal project, I came to the realisation I am severly misunderstanding some key concepts of security/encryption - and I am horribly embarrassed to ask for help on the subject.

I've got a project set up that reads and writes to an encrypted file (nodejs/nedb) I've been useing dotenv to setup my secret/salt as system variables with dotenv (\*/\*\*) and useing scryptsy to generate a key based on that information(\*\*\*)

&#x200B;

Even tho this issue is about file encryption, my question extends to database entry encryptions.

(\*) How/Why is this secure ? (it does not seem very secure) It seems to me that the only plus side to this as opposed to writing it plain text in code would be it is saved from codedumps/leaks ? - Surely when someone has gained access to the actual server it does not matter where you 'hide' it.

(\*\*) Is not the only real secure way to do this by entering the key manually on server startup via prompt ?

&#x200B;

(\*\*\*) This seems redundant ?

&#x200B;

&#x200B;

&#x200B;

&#x200B;

\-----------

Edit, wow a lot of replies - Thank you ever last one of you!
gpt
I think you're doing this already, but you didn't say it so just so we're on the same page, you put your secrets into a `.env` file, and then add that file to your `.gitignore`. If you're committing your dotenv file, then you might as well not have one.

The point then, is that your secrets do not live in source control. Your computer has a copy of your secrets, and if someone else joins your team, you give them a copy of your secrets some other secure way (LastPass Teams or 
Psono, for example).

If someone has pwned your server _without_ knowing your secrets i.e. by brute-forcing it, then yeah, you're fucked. But with modern encryption methods the chances of this happening are vanishingly small. With a few exceptions, every major attack you hear about now involves the attackers getting the password somehow (e.g. through social engineering).

This is only redundant if the data you're storing has no value. If you're just starting out with back-end services and making a database of cats, then sure, put your keys on GitHub. Nobody cares. But one day you're going to have the keys to your company's whole product just sitting on your laptop. On that day, you'll be glad you developed good habits when you were starting out, and haven't pushed your secret keys to GitHub.