Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to store and share passwords in a company?

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 297 posts

Re: Ask HN: How to store and share passwords in a company?

#131

Post by Normal_gaussian »

tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

That is the answer.

SSO, then password manager.

I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.

Re: Ask HN: How to store and share passwords in a company?

#132

Post by crazygringo »

karmakaze wrote: post #110
worldsayshi wrote: post #109

Earlier quoted context omitted.

I agree with this. But I want to ask a similar question as OP but for services. How do you handle service account credentials in a good way? Typically multiple engineers need to be able to test out a given service account. So a number of users need to have access to the credentials of that service account. And you need a good way to enroll a new service to service connection, i.e give a service account access to anot…

> the credentials of that service account Why do these accounts only have a single user/password? In any case, my answer would again be automation. Script the test, have the authorized process test out the service account on behalf of any employee who can create and run those tests.

Because that's just how some products are set up. Not every external service account provides separate passwords for different employees, there's just a single corporate account that some certain number of people need to have access to.

And automation isn't an answer to that. The question is how to share the password in the first place, not to automate what is done with it.

Re: Ask HN: How to store and share passwords in a company?

#133

Post by bankcust08385 »

Keeper for human-to-human ones that cannot be otherwise managed with individual account access and OpenBao (Vault fork) for automated secret generation and sharing. Implement an IdP (SSO and more) on-prem because it's so much more convenient and safer than outsourcing.

Re: Ask HN: How to store and share passwords in a company?

#134

Post by bankcust08385 »

tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

Never pay the "SSO tax" by outsourcing to Okta, etc. There many FOSS IdP solutions that are usable with some customization and integration.

Re: Ask HN: How to store and share passwords in a company?

#135

Post by bankcust08385 »

janstice wrote: post #127
tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

And when you set up 1Password, make sure you also get the CLI going, so passwords & shared gunk that's needed to access other people's services can be scripted, and when the passwords, etc get rotated no-one needs to know because no-one needs to store them.

[flagged]

Re: Ask HN: How to store and share passwords in a company?

#136

Post by AdieuToLogic »

Best fight? Don't be in one.

As many here have recommended, where possible employ authentication/authorization mechanisms which are not reliant upon account+password for everything. OIDC, OAuth2, Kerberos[0], and Active Directory[1] are all technologies worth considering.

Where possible, employ a per-developer sandbox development environment such that each can have a representative system able to support feature/integration tests without having to rely on the CI/CD workflow or a fully replicated production environment.

All of the above share a common theme - limit shared access while maximizing productivity.

As for access to support tools, like source code repositories, ticketing systems, wikis, HR systems, and the like, automate where possible to create the requisite accounts and recommend use of a password manager for same.

EDIT: bonus points for using a private organizational GitHub repo configured to execute GitHub actions that create the above support accounts when a new-hire PR is approved by authorized personnel.

0 - https://en.wikipedia.org/wiki/Kerberos_(protocol)

1 - https://en.wikipedia.org/wiki/Active_Directory

Re: Ask HN: How to store and share passwords in a company?

#137

Post by zie »

baxtr wrote: post #105
healsdata wrote: post #55

Earlier quoted context omitted.

> Yes, but they should be unique to your account. I.e. via SSO. This is a great best practice, but user-based value metrics for many SaaS platforms make this untenable for some IT departments. If folks have to log in seldomly, it's very hard to make the business case to pay per user. Similarly, there's many SaaS platforms that charge A LOT extra for SSO because you have to upgrade to their Enterprise-pricing model. I…

We change our PW for some platforms every month, so that people leaving won’t have access anymore

Well except for the period of time between them quitting and the new month rolls around.

You really should change passwords the second they leave. Yes it's a PITA, but you should do it anyway.

Re: Ask HN: How to store and share passwords in a company?

#139

Post by zie »

worldsayshi wrote: post #109
karmakaze wrote: post #103

Don't. Give them access to all systems they need with their own user/password. That way you can revoke them (if/when necessary) without disrupting everyone else. Also automate as much as is reasonable, e.g. github access to push code to a dev branch, then enqueue merging of it. But a CI/CD pipeline does the actual deploy, the employee doesn't need to access any of the production systems. A very small number still wil…

I agree with this. But I want to ask a similar question as OP but for services. How do you handle service account credentials in a good way? Typically multiple engineers need to be able to test out a given service account. So a number of users need to have access to the credentials of that service account. And you need a good way to enroll a new service to service connection, i.e give a service account access to anot…

The best way to handle service accounts is nobody knows the password. When X needs to troubleshoot, they change the password, do what needs to be done, then change it again afterwards, to some unknown value.

It's a lot easier if you automate the password delivery to the service account. 1Password can do this with their CLI offering and Vault/OpenBAO can also do this. There are other password managers that can do similar things as well.

With Vault/OpenBAO, for many services, it can handle password rotation and can even generate accounts(with appropriate permissions) for you, so you need access to Y service, Vault will create a temporary account. When the token expires, it will delete the account automatically.

If you can't get there yet, then you limit the damage by limiting the shared password to a small set of people, use a password manager and as soon as any one of them leave the group, rotate the password.

Re: Ask HN: How to store and share passwords in a company?

#140

Post by cedws »

tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

1Password is brilliant. They have all sorts of open source libraries and integrations on GitHub.
Post reply on HN