I can only say that using pass ( https://www.passwordstore.org/ ) is an absolute nightmare, in case anyone else is considering that It seems like perfect simplicity built on time-tested cryptography: store pgp-encrypted files in a git repository. We already had an internal git server and used PGP internally, it was the perfect marriage. The tool provides the common functions like selecting which colleagues to encrypt…
Strong disagree - I use pass and I love it. I switched from keepass and not looking back.
I guess it's for personal use, never tried using it in a company.
The best way to handle service accounts is nobody knows the password. When X needs to troubleshoot, they change the password, do what needs to be done, then change it again afterwards, to some unknown value. It's a lot easier if you automate the password delivery to the service account. 1Password can do this with their CLI offering and Vault/OpenBAO can also do this. There are other password managers that can do simi…
> The best way to handle service accounts is nobody knows the password. When X needs to troubleshoot, they change the password, do what needs to be done, then change it again afterwards, to some unknown value. one way i've seen this is on a 'lease' system: your user requests access to use the account, the system logs your request and generates a random password for you, you log in and use the account for the duration…
Hi! could you please explain what is this admin work that is bothering you? Thanks! (working at Dashlane, and happy to forward feedback to product team. I'll already forward your comment on pricing)
It’s not really your fault, it’s us bending your free tier into something it isn’t intended to be. Maximum number of passwords shared, only logging in to one device at a time etc. It’s a really weird edge case but eye opening for me as someone who is usually in a very well resourced tech environment. Google offers a great free tier for non profits and in the ideal world we’d have a password manager that plugs into ou…
You could self-host bitwarden on a $5 a month instance (or free-forever, if you choose to trust oracle or gcp), and then put TOTP 2fa into your bitwarden instance. Still requires a little maintenance on the instance, but this can be 99% automated.
Hi! could you please explain what is this admin work that is bothering you? Thanks! (working at Dashlane, and happy to forward feedback to product team. I'll already forward your comment on pricing)
It’s not really your fault, it’s us bending your free tier into something it isn’t intended to be. Maximum number of passwords shared, only logging in to one device at a time etc. It’s a really weird edge case but eye opening for me as someone who is usually in a very well resourced tech environment. Google offers a great free tier for non profits and in the ideal world we’d have a password manager that plugs into ou…
I've volunteered for and served on the boards of several small, youth-oriented nonprofits. They all had this weird idea that you can't spend any money on operational stuff. Yeah I get that you want to minimize it, and you should. But payments for necessary services should just be part of the budget. There is overhead to running these orgs and not every penny can go straight through to the kids. If you make things a PITA for the volunteers, eventually you won't have any volunteers. People are giving their time freely to help, but most are busy and don't want to f*ck around with complicated solutions that waste that time.
I know very little about PTAs, but... why would a PTA need to share passwords anyways, instead of having separate logins?
Immediate example that comes to mind: there’s a paid-for Canva account that multiple people need to use. Can’t use separate logins because then you’d need multiple subscriptions.
This is in breach of the tos though, right? Great example to set for the kids.
> the credentials of that service account Why do these accounts only have a single user/password? In any case, my answer would again be automation. Script the test, have the authorized process test out the service account on behalf of any employee who can create and run those tests.
Because that's just how some products are set up. Not every external service account provides separate passwords for different employees, there's just a single corporate account that some certain number of people need to have access to. And automation isn't an answer to that. The question is how to share the password in the first place, not to automate what is done with it.
I've bumped into this with various API integrations to e.g. warehousing systems, ERPs, hosting providers and what not. The advice in this thread works great until you are on a project to integrate X API into Y project, and you need the admin dashboard. Now you have three developers who all need to share one account.
In my experience, the surest way to security mess ups are when frustrated developers share credentials due to an overcomplicated sharing process of credentials. This obviously should not happen, but is why I am an advocate for 1Password.com.
They've made it simple for admins and users alike.
It really depends on how mature your org and stacks are. This is generally how I would do it. 1-20 people - password manager (bitwarden, 1pass, etc.) 20-30+ people - SSO 50+ people - start assigning real roles to your SSO schema 1-5 services - secrets in CircleCI and password manager is good enough. 5+ instances - use a secrets manager like Vault. 10+ instances - start using a secrets manager locally as well for dev.…
Are they engineers if they appeal to emotions when evaluating risk ?
Immediate example that comes to mind: there’s a paid-for Canva account that multiple people need to use. Can’t use separate logins because then you’d need multiple subscriptions.
This is in breach of the tos though, right? Great example to set for the kids.
Pretty sure the kids aren’t aware of the PTA’s use of Canva.