Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to store and share passwords in a company?

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 297 posts

Re: Ask HN: How to store and share passwords in a company?

#211

Post by matwood »

Hnrobert42 wrote: post #145
bankcust08385 wrote: post #135

Earlier quoted context omitted.

[flagged]

You're going to have to elaborate. I've been using 1pw for about 7 years, including at several startups where I've handled IT. It has worked really well, yet to be breached, has a CLI, handles passkeys and SSH keys, easily separates work and personal creds, and their support is fantastic. What specifically is terrible?

People are still upset from when it went from a mac native user focused app to a subscription based multi-platform enterprise focused app.

Re: Ask HN: How to store and share passwords in a company?

#213

Post by notepad0x90 »

Cyberark works great for this, it even lets you avoid having to share passwords for things like ssh and rdp. There are several vendors in this space. The new hire in your scenario would be added to the right group, that group's members would have access to the right PAM tool vault. when they leave the company, they get removed from that group, thus removing their access. Shared passwords can also be managed passwords that get auto-rotated every so often.

Re: Ask HN: How to store and share passwords in a company?

#214

Post by forty »

afavour wrote: post #191
ZuLuuuuuu wrote: post #184

Earlier quoted context omitted.

We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated…

Pricing is truly annoying with password managers. I know this is an edge case but I volunteered for my kid’s school PTA and discovered to my horror that all the passwords were stored in a single Google Sheet. But the pricing for the number of users we were looking at (a very small core number of staff but a large number of volunteer parents) made pretty much every password manager service unaffordable, even with non…

Hi! could you please explain what is this admin work that is bothering you? Thanks! (working at Dashlane, and happy to forward feedback to product team. I'll already forward your comment on pricing)

Re: Ask HN: How to store and share passwords in a company?

#215

Post by andriosr »

We had this problem at my last job - ended up building our own system cause nothing really fit.

Some tips from what we learned: 1. don't use shared spreadsheets or docs, way too easy to mess up 2. need granular access controls + audit logs 3. automate onboarding/offboarding as much as possible 4. rotate creds regularly, especially for sensitive stuff 5. use SSO where you can to minimize password sprawl

There are some decent enterprise password managers out there, but they get pricey fast as you scale. We ended up using a combo of 1password for team passwords + a custom system built on top of vault by hashicorp for machine creds/api keys etc.

One thing that worked well was having "password owners" for each system who were responsible for rotations, access reviews etc. helps distribute the work.

If you want something more turnkey, you might want to check out hoop.dev - does a lot of this stuff out of the box, including automated access reviews, just-in-time access etc.

Whatever you do, just please don't use a shared google doc :)

Re: Ask HN: How to store and share passwords in a company?

#216

Post by patrakov »

rdl wrote: post #207
chickahoona wrote: post #203

Earlier quoted context omitted.

Ever tried Psono? (I am Sascha, the main developer behind it) It has SSO / encryption / self hosting / ... and even the enterprise version is free for up to 10 users and if you need more you only pay €2.5 / user / month.

Passkey support (I know it's a pain) would be great...

Use Vaultwarden then

Re: Ask HN: How to store and share passwords in a company?

#217

Post by coder543 »

afavour wrote: post #191
ZuLuuuuuu wrote: post #184

Earlier quoted context omitted.

We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated…

Pricing is truly annoying with password managers. I know this is an edge case but I volunteered for my kid’s school PTA and discovered to my horror that all the passwords were stored in a single Google Sheet. But the pricing for the number of users we were looking at (a very small core number of staff but a large number of volunteer parents) made pretty much every password manager service unaffordable, even with non…

I know very little about PTAs, but... why would a PTA need to share passwords anyways, instead of having separate logins?

Re: Ask HN: How to store and share passwords in a company?

#218

Post by marcosdumay »

codethief wrote: post #205
marcosdumay wrote: post #142

Earlier quoted context omitted.

> What risks & attack vectors do you have in mind here? People with deleted passwords not being able to access the old file, or really any kind of mistake being irreversible.

I'm afraid I'm still not following. Isn't the point of having a history precisely to be able to roll back in case of mistakes?

You don't want a rigid history on the case of some mistake exposing the data. (Like a weak password.)

Backups that you can erase work fine, but version control will create trouble.

Re: Ask HN: How to store and share passwords in a company?

#219

Post by lostlogin »

Normal_gaussian wrote: post #131
tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.

> LastPass

There was the time they lost customer data in a hack and then lots of customers data was exploited. https://en.m.wikipedia.org/wiki/LastPass

Post reply on HN