Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to store and share passwords in a company?

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 297 posts

Re: Ask HN: How to store and share passwords in a company?

#181

Post by Xylakant »

pxc wrote: post #148
Xylakant wrote: post #31

Earlier quoted context omitted.

We uses D the same approach for a while. Pass/gopass will do that for you. However, the downside here is that it quickly gets unwieldy as you’ll end up with a relatively large vaults. And you can’t really remove people, they can always keep and decrypt old versions of the vault, that means that you do have to rotate all of the secrets in that vault manually if someone leaves. And then, there’s also the support cost f…

> And you can’t really remove people, they can always keep and decrypt old versions of the vault, that means that you do have to rotate all of the secrets in that vault manually if someone leaves. And then, there’s also the support cost for non-tech people. GPG on windows is a particular pain. In a way doesn't this just more directly reflect the reality that anyone you've ever given access to a password may have made…

Absolutely. My point is that pass/gopass in practice lead to larger vaults, so.you need to rotate more passwords. And more advanced password managers offer assistance for that task, which the more basic ones do not.

Re: Ask HN: How to store and share passwords in a company?

#182

Post by ZuLuuuuuu »

thih9 wrote: post #172

People overwhelmingly recommend SSO. Isn’t that lowering the security level? If that single account gets taken over, the attacker has access everywhere else too. Some places let you configure SSO+2FA, which helps; but in most cases clicking a social login button gets you full access. And speaking of a single point of failure, cloud password managers look even worse[1]. [1]: https://thehackernews.com/2023/02/lastpass-…

SSO + 2FA is more secure in practice than letting people create/manage their own accounts at every service. Because:

- You can force a password policy centrally (minimum 12 char + uppercase/lowercase + number etc), for every service the company is using that supports SSO.

- You can force 2FA, again for every service the company is using that supports SSO.

- You can disable an account immediately from the central admin panel as soon as you notice an account is stolen.

- When the employee leaves the company, you can delete their account centrally from every service, so there are no inactive company accounts registered to various services.

Re: Ask HN: How to store and share passwords in a company?

#184

Post by ZuLuuuuuu »

Normal_gaussian wrote: post #131
tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.

We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated with your SSO which means 3600$ per year.

Re: Ask HN: How to store and share passwords in a company?

#185

Post by Hikikomori »

thih9 wrote: post #172

People overwhelmingly recommend SSO. Isn’t that lowering the security level? If that single account gets taken over, the attacker has access everywhere else too. Some places let you configure SSO+2FA, which helps; but in most cases clicking a social login button gets you full access. And speaking of a single point of failure, cloud password managers look even worse[1]. [1]: https://thehackernews.com/2023/02/lastpass-…

Always use 2fa with sso. You can also use client certificates with sso so only managed devices can use it.

Re: Ask HN: How to store and share passwords in a company?

#186

Post by MrDrMcCoy »

ZuLuuuuuu wrote: post #184
Normal_gaussian wrote: post #131

Earlier quoted context omitted.

That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.

We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated…

Why not self-host Vaultwarden? It implements most functionality and supports the standard Bitwarden clients with virtually no resource requirements.

Re: Ask HN: How to store and share passwords in a company?

#187

Post by bheadmaster »

tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

You can even avoid using passwords altogether by using hardware security keys.

Re: Ask HN: How to store and share passwords in a company?

#188

Post by ZuLuuuuuu »

MrDrMcCoy wrote: post #186
ZuLuuuuuu wrote: post #184

Earlier quoted context omitted.

We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated…

Why not self-host Vaultwarden? It implements most functionality and supports the standard Bitwarden clients with virtually no resource requirements.

I'll look into it, thanks!

Re: Ask HN: How to store and share passwords in a company?

#189

Post by steve1977 »

wodenokoto wrote: post #156
tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

What’s SSO and how do I put vendor API keys into it? Like one of the most important APIs we have is just 1 key and that’s it. I don’t think the vendor has heard the term “key rotation”

I would recommend you get some people with IT security knowledge on board, either permanently or at least to do a review.

Re: Ask HN: How to store and share passwords in a company?

#190

Post by steve1977 »

healsdata wrote: post #55
zie wrote: post #30

> We tend to have zillions of passwords in IT jobs right? Yes, but they should be unique to your account. I.e. via SSO. > What are the recommended ways to store and give access to passwords? Whenever possible, don't. Otherwise, it depends on the scale and security you need. A password manager is one possible solution. Another solution is something like Hashicorp's Vault or OpenBao. > How can a new hire be given acces…

> Yes, but they should be unique to your account. I.e. via SSO. This is a great best practice, but user-based value metrics for many SaaS platforms make this untenable for some IT departments. If folks have to log in seldomly, it's very hard to make the business case to pay per user. Similarly, there's many SaaS platforms that charge A LOT extra for SSO because you have to upgrade to their Enterprise-pricing model. I…

> So while there is a best practice, dismissing solutions that are "good enough" (while sharing tradeoffs) isn't as helpful.

In many environments, sharing passwords is never "good enough".

Post reply on HN