Hacker News new | ask | show | jobs
by Yeri 1580 days ago
I guess rotating one key is easier though. Just update in 1psw and done.
1 comments

But why are you "rotating" keys? Most of the reasons people give involve unnecessary exposure of the private key material, which is exactly what you're encouraging by having 1password keep these keys instead of them living on individual hardware.
Well keeps are also shared via chat or emails and people exit the company. Sure taking out one key is more precise but rotating all is probably easier
You may notice they aren't called "Fun size sharing keys" or "Family pack keys" but instead "Private keys" because of that word "Private".

You don't need to wait for people to "exit the company". Sharing private keys was wrong, invalidate those keys. If somebody else knows your private key it isn't private any more. Get this stuff right and rotating keys is unecessary, get it wrong and rotating keys can't help you.