Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage passwords in teams?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 69 posts

Re: Ask HN: How do you manage passwords in teams?

#21

Post by danpalmer »

artie_effim wrote: post #4

you don't - you use an directory (LDAP, Active Directory) or AAA service (RADIUS,TACACS+) to manage that. There should never be a shared password. If it is a cloud shared service, same rules apply. You have to know who did what when, and with a shared PW you cannot. Even if all people have the same privileges, you gotta know who did what.

In my experience this is what it often boils down to. If access control isn't possible, it immediately and totally rules out using that service. For many companies this is how they have to operate for auditing purposes, and they have to be audited otherwise their clients can't use them, etc.

Although to be honest, out sourcing things like this is often not possible in itself. For internal passwords, everything should be linked to a single-sign-on system of some sort I think.

Re: Ask HN: How do you manage passwords in teams?

#22

Post by MehdiEG »

I researched this 3 years ago for our startups and couldn't find anything really good that lets me easily and securely share passwords on a need-to-know basis to team members and see who has access to what. Which baffles me because this is a problem that every single startup and small company must have.

In the end, we went for https://www.passpack.com/. They're clearly a small shop but it's been designed from the ground up for teams, they appear to care and know what they're doing when it comes to security (only have their word for it though obviously). Their web interface doesn't look like much but it's insanely fast and really well thought out, making inputing and looking for password really quick and easy. For some reason their pricing is ridiculously low - it costs next to nothing.

Two bad points: no native mobile app, making it a huge pain to look up password on the go + paranoid on the security front, which means that logging in is always a big pain. That unfortunately means that we were never able to convince anyone to really embrace it. Convenience and security is always a balancing act and Passpack is definitely leaning on the security side (understandable obviously). TBH, if they had a good native iOS app, I think it could make a difference for them. Instead of being this really annoying tool you're forced to use at work, they could become something that everyone uses as part of their daily personal life which would make it easier to get it adopted at work.

Re: Ask HN: How do you manage passwords in teams?

#23

Post by olegp »

We've been doing research on this at StartHQ (https://starthq.com) since we offer a web app launcher and new tab replacement extension (like the old Chrome New Tab page, but better) & SaaS password management would be a logical extension to that.

Out of the 20+ companies we've interviewed so far one had heard of Okta & none had heard of Bitium and Meldium, the main players in this space. One was using LastPass.

Most do not have a strict password policy and the current solutions include storing them in other web services like Trello and Google Docs, or sharing logins within a team using post it notes or via email.

One trend that I've clearly spotted though is the use of Google Apps to consolidate identity management in the cloud. This is often synced with AD via LDAP. Whenever possible, companies encourage but do not enforce the use of Google for logging into third party services. This makes offboarding a lot easier and that is the main pain point, as opposed to onboarding of new employees. This is further confirmed by SaaS providers saying that they see up to 60% of all their logins being done through Google Apps.

Re: Ask HN: How do you manage passwords in teams?

#24

Post by zimbatm »

nickpresta wrote: post #7

We use Meldium[1] with Google Apps login to manage our passwords. [1]: https://meldium.com/

That looks convenient.

The problem is that for them to log you in they have to store your passwords in clear. It seems like the data is encrypted in their back-end but the webapp has probably the decoding key. https://www.meldium.com/security

Re: Ask HN: How do you manage passwords in teams?

#26

Post by csarva »

TheSilentMan wrote: post #6
emilpalm wrote: post #3

I'v used a shared dropbox folder with a KeePassX instance in it with a shared password for that container. If needed we could just change the password on the KeePassX container and/or remove the access to dropbox.

Neither of those stop someone who saved a copy of the keepass db outside of dropbox. You'd also have to change every password contained in keypass.

Same goes for any centralized service you may use. You are still able to copy passwords manually into a text file, local keepass, etc. True, it is easier with a shared keepass, but the challenge is the same if you truly need to make sure a former employee can no longer access anything.

Re: Ask HN: How do you manage passwords in teams?

#30

Post by treskot »

My company uses LastPass. It's a nice service. - The admin will have control over what service you need to have access to. - Change password often and will be accessible by team mates without having to remember anything.

Simplifies a lot of other things, all you have to remember is the master password.

Post reply on HN