Hacker News new | ask | show | jobs
by pedrocr 4454 days ago
>Con: Doesn't protect against attacks that can read files readably by the webserver.

This isn't a con for the custom API, it's a con for a forking solution instead of a serialization between two different users.

If PKCS#11 is indeed a good fit for that protocol then it's indeed a much better solution that something custom for the reasons you mention. Good luck with the implementation.