Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to store and share passwords in a company?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 297 posts

Re: Ask HN: How to store and share passwords in a company?

#111

Post by xyst »

Question: has anybody actually worked in a password-less or even “zero trust” environment?

Most environments I have worked with struggle with sharing passwords like OP and it’s a massive pain. One time, dev team was sharing active directory credentials to access service. At some point service account gets locked because someone was using an older password of the account.

Usually a quick problem to solve with 2-3 people in same region (or prevented entirely), but teams across time zones and countries (US vs Vietnam or India). It becomes painful. Doesn’t matter if they are “senior” or green/“junior” engineers.

If I ever have my own company, I want my own internal IdP (identity provider) and all internal and external services integrated with it. Employees issued (multiple) physical hardware keys. This is required to authenticate with work computer and subsequent access to VPN/tail scale.

Individual services and products must support oauth.

Access to public cloud resources? AuthN through company IdP. Admin creates roles for you to access resources necessary for work

Access to database? No shared passwords. get admin to add authorization, then authN via IdP and get access token

Version control? Same as above.

E-mail? Same as above.

Company document repository? AuthN through IdP which requires physical security key.

Access to company laptop/desktop? Plug-in security key. Permissions/roles managed remotely (give bob sys access for dev work but jenny from HR is given very basic system access).

Then once you are done, then remove security key and all established sessions are removed and logged out of computer (or just locked).

Employee leaves? Just disable the account. Maybe leave a small window of access to certain services (ie, email) so they could say their goodbyes, turn in company equipment. Then revoke access completely.

Hostile or state actor obtained security key of active employee? From IdP, mass revoke all access. Can also track what actor accessed as well.

With this, problem OP has proposed has disappeared completely.

Re: Ask HN: How to store and share passwords in a company?

#112

Post by bootloop »

theideaofcoffee wrote: post #10

Lots of people suggest 1Password, and it works really well for larger or more disperse groups needing some shared vault capability, and perhaps those that want a more visual-driven web interface. Keep in mind there is the per-seat pricing for that. What has also worked really well in the past for me and my teams, especially if they are more technical and these credentials really never need to go beyond this more tech…

I use a similar flow with the technical team to avoid unencrypted credentials in SCM. The vault (or other secrets) are encrypted with a common passphrase and then only this passphrase is whats encrypted with GPG for multiple recipients.

Re: Ask HN: How to store and share passwords in a company?

#113

Post by Terretta »

ChrisMarshallNY wrote: post #76

We always used 1Password[0]. We still use it in the open-source projects that I work with. I have heard that LastPass is about as good, but have no experience using it. The latest version of 1Password isn't so good, but it works fine. [0] https://1password.com

More specifically, for OP's small business / company question ...

Start here: https://1password.com/product/teams-small-business-password-...

Fix your SSH logins here: https://developer.1password.com/docs/ssh

Then, go here to use from CLI: https://developer.1password.com/docs/cli/get-started/

Explore more advanced options like service accounts: https://developer.1password.com/docs/service-accounts

Or other integrations: https://developer.1password.com/docs/integrations/

Re: Ask HN: How to store and share passwords in a company?

#114

Post by wavemode »

xyst wrote: post #111

Question: has anybody actually worked in a password-less or even “zero trust” environment? Most environments I have worked with struggle with sharing passwords like OP and it’s a massive pain. One time, dev team was sharing active directory credentials to access service. At some point service account gets locked because someone was using an older password of the account. Usually a quick problem to solve with 2-3 peop…

This setup strongly describes how the process was inside Amazon.

Re: Ask HN: How to store and share passwords in a company?

#115

Post by SkyPuncher »

karmakaze wrote: post #103

Don't. Give them access to all systems they need with their own user/password. That way you can revoke them (if/when necessary) without disrupting everyone else. Also automate as much as is reasonable, e.g. github access to push code to a dev branch, then enqueue merging of it. But a CI/CD pipeline does the actual deploy, the employee doesn't need to access any of the production systems. A very small number still wil…

Unfortunately, some services don’t allow this.

Re: Ask HN: How to store and share passwords in a company?

#116

Post by a_bonobo »

fpoling wrote: post #49

At my previous work 1Password was replaced with Keeper. The main reason was better integration with SSO as Keeper can be unlocked with SSO itself so the user needs to remember just single password and for the rest either SSO was used directly or Keeper was used for other passwords.

We also use Keeper via SSO. We had Lastpass before and switched for obvious (breach of their vault) reasons. It's OK? It does its job.

Re: Ask HN: How to store and share passwords in a company?

#119

Post by ethbr1 »

worldsayshi wrote: post #109
karmakaze wrote: post #103

Don't. Give them access to all systems they need with their own user/password. That way you can revoke them (if/when necessary) without disrupting everyone else. Also automate as much as is reasonable, e.g. github access to push code to a dev branch, then enqueue merging of it. But a CI/CD pipeline does the actual deploy, the employee doesn't need to access any of the production systems. A very small number still wil…

I agree with this. But I want to ask a similar question as OP but for services. How do you handle service account credentials in a good way? Typically multiple engineers need to be able to test out a given service account. So a number of users need to have access to the credentials of that service account. And you need a good way to enroll a new service to service connection, i.e give a service account access to anot…

You need to be able to automate 3 things:

   1. Account pass retrieval
   2. Account pass rotation
   3. Account pass ref update
(1) is how a user gets the pass when needed (normal process or break glass debug). (2) is how the pass rotates to an unknown value, automatically, after the user is done with it. (3) is how the new value gets updated in references, without the user knowing the new value.

At the root of any solution are answers to those 3 needs.

Re: Ask HN: How to store and share passwords in a company?

#120

Post by mmsc »

Bitwarden can be used with groups, or even Google Sheets or something with proper access control (both are just kv after all... both should require 2fa, and both include auditing)

There's no good solution imo for what I think you're asking for (and that isn't: how can I share passwords for services that allow SSOv?)

"This reminds me of a problem that I wanted to solve in the future, but I don’t have the expertise. The problem is when an organization has a single account on an external service which needs to be used by several people, and the organization wants to safely manage the access to the shared account on the external service, adding accountability: who was using the account at X time? Users of the shared external account should not know the credentials of the account, so rotation of passwords when employees leave/change roles is not as necessary. I thought of something like a proxy which could use a Selenium (or something else) script for each of the external website, which would handle the login/authentication flow for the external service.If this was a business, those scripts could be offered as a per-website/month package. An administrator would create the automatic flow for a specific service, and save the username and password somewhere in the script. Normal users of the external service’s singular account would then use the proxy using their individual credentials, to add accountability to accessing the external service. Maybe someone in this realm could come up with something and market it."

Post reply on HN