Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to store and share passwords in a company?

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 297 posts

Re: Ask HN: How to store and share passwords in a company?

#191

Post by afavour »

ZuLuuuuuu wrote: post #184
Normal_gaussian wrote: post #131

Earlier quoted context omitted.

That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.

We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated…

Pricing is truly annoying with password managers. I know this is an edge case but I volunteered for my kid’s school PTA and discovered to my horror that all the passwords were stored in a single Google Sheet. But the pricing for the number of users we were looking at (a very small core number of staff but a large number of volunteer parents) made pretty much every password manager service unaffordable, even with non profit discounts. Per seat pricing doesn’t work out for everyone.

We ended up using Dashlane because its free tier allows sharing between users but the administration is so much more work than it needs to be.

Re: Ask HN: How to store and share passwords in a company?

#193

Post by f4c39012 »

cedws wrote: post #140
tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

1Password is brilliant. They have all sorts of open source libraries and integrations on GitHub.

1password is solid, and works everywhere and in most situations. Features are however quite limited on the more basic packages

Re: Ask HN: How to store and share passwords in a company?

#194

Post by tonnydourado »

The first step for safely sharing passwords is not doing it. SSO as much as possible, give people actual accounts where not.

As a last resource, at a Former Employer™, people put a public key in their profile, and we used GPG to encrypt secrets and paste the encrypted value on Slack/Teams. This was only among developers, and there was a tutorial for setting up the GPG GUI and encrypting values with it, so it worked fine. But we did also actively worked towards not needing that as much as possible.

Re: Ask HN: How to store and share passwords in a company?

#195

Post by wvh »

I'd use `pass`, which I use personally, but it's a hard sell for people not as technically proficient. I've worked with all kinds of solutions both online and on-premise such as 1pass and vault. Ideally a meticulous SSO setup would replace all passwords except for perhaps one; the user identifies to the IdP, which then relays enough information to dependent parties to determine what that user can do. The problem is that getting proper SSO, identity and permission support across all software in use in a company requires a level of effort that few are willing to pay for internally these days, though newer software is a lot more flexible and usually has proper OIDC support.

On the other hand, external SaaS is still hard to integrate into your own IdP, so I guess we are stuck with some forms of passwords for some time to come.

Re: Ask HN: How to store and share passwords in a company?

#196

Post by koliber »

tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

On top of this, prefer individual accounts and passwords over shared accounts.

Some services require shared passwords, keys, or tokens. Consider grouping them by sensitivity. Key to the kingdom shared accounts should be accessible only to a tiny number of people.

Finally, never send credentials over plaintext, such as email or Slack. 1Password and other password managers have a “share” feature. If need be, send a zipped and encrypted text file and share the password via a voice call.

Re: Ask HN: How to store and share passwords in a company?

#197

Post by jon-wood »

xyst wrote: post #111

Question: has anybody actually worked in a password-less or even “zero trust” environment? Most environments I have worked with struggle with sharing passwords like OP and it’s a massive pain. One time, dev team was sharing active directory credentials to access service. At some point service account gets locked because someone was using an older password of the account. Usually a quick problem to solve with 2-3 peop…

This setup is absolutely the ideal. Sadly it doesn’t often survive first contact with reality.

Bob in sales will sign up for a tool that suddenly becomes load bearing, and it doesn’t support SSO without a 10x increase in the monthly fee. A million dollar client needs you to integrate with one of their services which only supports a single shared API key. And so on.

You also have to consider whether doing the heavy lifting required to get to this point is really the highest priority for your one man company which is yet to make a single penny and has no customers. What you describe is certainly much easier to implement early on when you’re not dealing with a ton of legacy services, but it will still probably take a few weeks of work to make it reliable for everything.

Re: Ask HN: How to store and share passwords in a company?

#198

Post by duckmysick »

wodenokoto wrote: post #156
tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

What’s SSO and how do I put vendor API keys into it? Like one of the most important APIs we have is just 1 key and that’s it. I don’t think the vendor has heard the term “key rotation”

For API keys you want to look into secrets management, for example Hashicorp Vault or OpenBao. AWS/Azure/Google Cloud also have their own secrets management features.
Post reply on HN