Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to store and share passwords in a company?

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 297 posts

Re: Ask HN: How to store and share passwords in a company?

#251

Post by Melatonic »

afavour wrote: post #191
ZuLuuuuuu wrote: post #184

Earlier quoted context omitted.

We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated…

Pricing is truly annoying with password managers. I know this is an edge case but I volunteered for my kid’s school PTA and discovered to my horror that all the passwords were stored in a single Google Sheet. But the pricing for the number of users we were looking at (a very small core number of staff but a large number of volunteer parents) made pretty much every password manager service unaffordable, even with non…

Why not just use something like Keepass in this scenario for free (forever) ?

Re: Ask HN: How to store and share passwords in a company?

#252

Post by afavour »

woleium wrote: post #244
afavour wrote: post #228

Earlier quoted context omitted.

It’s not really your fault, it’s us bending your free tier into something it isn’t intended to be. Maximum number of passwords shared, only logging in to one device at a time etc. It’s a really weird edge case but eye opening for me as someone who is usually in a very well resourced tech environment. Google offers a great free tier for non profits and in the ideal world we’d have a password manager that plugs into ou…

You could self-host bitwarden on a $5 a month instance (or free-forever, if you choose to trust oracle or gcp), and then put TOTP 2fa into your bitwarden instance. Still requires a little maintenance on the instance, but this can be 99% automated.

Yeah, the thought has occurred to me. But I’m only going to be there for a few years, the responsible thing is to do something that’ll survive long after I’m gone.

Re: Ask HN: How to store and share passwords in a company?

#254

Post by insane_dreamer »

koliber wrote: post #196
tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

On top of this, prefer individual accounts and passwords over shared accounts. Some services require shared passwords, keys, or tokens. Consider grouping them by sensitivity. Key to the kingdom shared accounts should be accessible only to a tiny number of people. Finally, never send credentials over plaintext, such as email or Slack. 1Password and other password managers have a “share” feature. If need be, send a zip…

> never send credentials over plaintext, such as email or Slack

Slack works for us in a very small (1. New/updated password(s) to be shared are in an encrypted Keypass file (encrypted with a preset and prearranged password that was only shared once offline). Recipient merges into their local keypass file.

2. Confirm recipient is online, send, confirm receipt, delete immediately afterwords.

We use many AWS services so obv all those are handled with AWS Secrets and IAM, so we only need to save the login pwd externally. And for services which support multi-user, Google, GitHub, etc., each user has their own pwd. So not many passwords need to be shared in the above manner. In daily use I keep KeyPass open and copy/paste passwords into the browser when needed -- nothing stored online.

Re: Ask HN: How to store and share passwords in a company?

#255

Post by Sat_P »

SoftTalker wrote: post #245
afavour wrote: post #228

Earlier quoted context omitted.

It’s not really your fault, it’s us bending your free tier into something it isn’t intended to be. Maximum number of passwords shared, only logging in to one device at a time etc. It’s a really weird edge case but eye opening for me as someone who is usually in a very well resourced tech environment. Google offers a great free tier for non profits and in the ideal world we’d have a password manager that plugs into ou…

I've volunteered for and served on the boards of several small, youth-oriented nonprofits. They all had this weird idea that you can't spend any money on operational stuff. Yeah I get that you want to minimize it, and you should. But payments for necessary services should just be part of the budget. There is overhead to running these orgs and not every penny can go straight through to the kids. If you make things a P…

Completely agree. The kind of people I've encountered in non-profits and charities as an IT Sales Professional over 20 years is that they expect great products and services should be as close to free as possible. They don't seem to understand that the tax breaks and incentives are there precisely to help soften the costs of running such an organisation. To expect even MORE than that from vendors is unrealistic. I watched an interview with Naveen Jain (Viome CEO) on a podcast once and he said that a non-profit entrepreneur or CEO is more often than not "just a sh*tty entrepreneur". I couldn't agree more based on my experience selling tech since 2001!

Re: Ask HN: How to store and share passwords in a company?

#256

Post by afavour »

SoftTalker wrote: post #245
afavour wrote: post #228

Earlier quoted context omitted.

It’s not really your fault, it’s us bending your free tier into something it isn’t intended to be. Maximum number of passwords shared, only logging in to one device at a time etc. It’s a really weird edge case but eye opening for me as someone who is usually in a very well resourced tech environment. Google offers a great free tier for non profits and in the ideal world we’d have a password manager that plugs into ou…

I've volunteered for and served on the boards of several small, youth-oriented nonprofits. They all had this weird idea that you can't spend any money on operational stuff. Yeah I get that you want to minimize it, and you should. But payments for necessary services should just be part of the budget. There is overhead to running these orgs and not every penny can go straight through to the kids. If you make things a P…

Oh, I totally agree. But I’m in the minority in that view and have come to accept that it’s just the nature of the beast.

Re: Ask HN: How to store and share passwords in a company?

#257

Post by gpvos »

imglorp wrote: post #230
lostlogin wrote: post #219

Earlier quoted context omitted.

> LastPass There was the time they lost customer data in a hack and then lots of customers data was exploited. https://en.m.wikipedia.org/wiki/LastPass

Not once but multiple breaches. Just no.

I'm surprised they still exist.

Re: Ask HN: How to store and share passwords in a company?

#260

Post by KabukiOrigin »

Single Sign On (SSO) for all applications as the default. That will do 80%+ of what you want. Thycotic (Delinea) Secret Server for API keys, break-glass accounts, etc. If you have a more granular need for Privileged Access Management (PAM) there are enterprise tools for that. (I don't recommend BeyondTrust; I've heard CyberArk is decent but haven't used it.)

You could do a mid-roll-your-own with Bitwarden commercial, etc., though consider the operational management overhead.

Post reply on HN