Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to store and share passwords in a company?

news.ycombinator.com

Post reply on HN
Print view View original

261–270 of 297 posts

Re: Ask HN: How to store and share passwords in a company?

#261

Post by crazygringo »

lolinder wrote: post #126
SkyPuncher wrote: post #115

Earlier quoted context omitted.

Unfortunately, some services don’t allow this.

Ideally they would support SSO, but at a minimum any service that wants business customers will have accounts in some form. If they don't even have that then I would seriously second guess using them for anything in production. They're clearly not designed for businesses and can't be relied upon to not screw you up in serious ways.

> but at a minimum any service that wants business customers will have accounts in some form.

I mean, that's just not true. Plenty of successful and widely used businesses out there provide a single account/password for their service at a client company, rather than for each human user at that client company. It's a common pattern even if you think it shouldn't be. And yes they are designed for businsses and have business customers.

For a lot of products, it's just not conceptually necessary to have multiple users for an account, i.e. support for "teams". It's a convenience that might be on the roadmap and might get done eventually, or not at all. Especially because supporting complex sets of user credentials can be a major project, which means another important feature doesn't get done instead.

Re: Ask HN: How to store and share passwords in a company?

#262

Post by tetha »

ZuLuuuuuu wrote: post #182
thih9 wrote: post #172

People overwhelmingly recommend SSO. Isn’t that lowering the security level? If that single account gets taken over, the attacker has access everywhere else too. Some places let you configure SSO+2FA, which helps; but in most cases clicking a social login button gets you full access. And speaking of a single point of failure, cloud password managers look even worse[1]. [1]: https://thehackernews.com/2023/02/lastpass-…

SSO + 2FA is more secure in practice than letting people create/manage their own accounts at every service. Because: - You can force a password policy centrally (minimum 12 char + uppercase/lowercase + number etc), for every service the company is using that supports SSO. - You can force 2FA, again for every service the company is using that supports SSO. - You can disable an account immediately from the central admi…

> - You can force 2FA, again for every service the company is using that supports SSO.

This can also be a way to balance security and user convenience, which should not be underestimated.

If a user has to do the MFA dance (Duo Pushes, TOTP tokens, ...) once a day for a dozen different services, users will rightfully riot and start looking for workarounds of questionable security. On the other hand, you could have one MFA dance in the morning to get your keycloak session, it is kept alive by normal usage and then it doesn't bother you anymore for the day. Much lower friction.

Another thing is auditing and analysis. With central logins, you need one service with good audit logging, and you need to understand and alert on one log if a user suddenly tries to login from another continent, hundreds of times a minute. Some of these services have this built-in.

Re: Ask HN: How to store and share passwords in a company?

#263

Post by trinsic2 »

teekert wrote: post #202
MrDrMcCoy wrote: post #186

Earlier quoted context omitted.

Why not self-host Vaultwarden? It implements most functionality and supports the standard Bitwarden clients with virtually no resource requirements.

Was going to suggest the same, of course you're taking matters into your own hands, so know what you are doing, but it's free, very light weight and supports "organizations" as a way of sharing passwords between people. I have hosted it for my family for years and was very happy with it (until I switched to Proton Family, now doing ProtonPass). And you get all the excellent Bitwarden apps and extensions to go with it…

You trust Proton with that data?

Re: Ask HN: How to store and share passwords in a company?

#264

Post by trinsic2 »

noname120 wrote: post #229
Normal_gaussian wrote: post #131

Earlier quoted context omitted.

That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.

I was first using 1Password and then I really tried to love Bitwarden for two entire years (paid user). But it was riddled with bugs and UX mishaps. I gave them detailed feedback by email, they acknowledged it, but nothing changed and my frustration grew over time. I eventually switched back to 1Password one year ago and I'm delighted. For example here some issues I flagged to the team. Note that some of them may pos…

Thanks for spending the time on that list. Hopefully Bitwarden will see this and reprioritize there game plan. You cant have a solid password manager without these things working. I have been using Keepass for years, but was thinking about switch to another product in the future, but I think I am going to stay with Keepass.

Re: Ask HN: How to store and share passwords in a company?

#265

Post by teekert »

trinsic2 wrote: post #263
teekert wrote: post #202

Earlier quoted context omitted.

Was going to suggest the same, of course you're taking matters into your own hands, so know what you are doing, but it's free, very light weight and supports "organizations" as a way of sharing passwords between people. I have hosted it for my family for years and was very happy with it (until I switched to Proton Family, now doing ProtonPass). And you get all the excellent Bitwarden apps and extensions to go with it…

You trust Proton with that data?

I certainly do, I have not seen anything yet that makes me reconsider. They have always answered to concerns well. They pass security audits.

Sure I'd prefer a Linux Proton Drive client over a BTC wallet, but nobody's perfect.

Re: Ask HN: How to store and share passwords in a company?

#266

Post by lolinder »

crazygringo wrote: post #261
lolinder wrote: post #126

Earlier quoted context omitted.

Ideally they would support SSO, but at a minimum any service that wants business customers will have accounts in some form. If they don't even have that then I would seriously second guess using them for anything in production. They're clearly not designed for businesses and can't be relied upon to not screw you up in serious ways.

> but at a minimum any service that wants business customers will have accounts in some form. I mean, that's just not true. Plenty of successful and widely used businesses out there provide a single account/password for their service at a client company, rather than for each human user at that client company. It's a common pattern even if you think it shouldn't be. And yes they are designed for businsses and have bus…

> And yes they are designed for businsses and have business customers.

What I'm saying is that by definition these aren't designed for businesses. They might have business customers, they might even think that that's where their primary market is, but they're not designed for businesses if they use an account model that is designed for single consumer. And if they can't have been bothered to put together an account system then what else didn't they bother doing?

I'm not buying the idea that an account system is just too complicated and would eat up too much time. There are only a few extra moving parts (teams, very basic roles) for an enormous quality of life improvement for the company (this entire thread would be largely unnecessary if every product a business used supported at least basic account management).

Re: Ask HN: How to store and share passwords in a company?

#267

Post by jraph »

razakel wrote: post #204
ZuLuuuuuu wrote: post #184

Earlier quoted context omitted.

We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated…

We went with self-hosted Passbolt. Free, open source, and based on PGP. Only downside is having to explain PGP to the less technical users...

We use passbolt too, I'm not sure I ever had to mess with pgp once.

It seems to work well / just works.

Re: Ask HN: How to store and share passwords in a company?

#268

Post by codethief »

marcosdumay wrote: post #218
codethief wrote: post #205

Earlier quoted context omitted.

I'm afraid I'm still not following. Isn't the point of having a history precisely to be able to roll back in case of mistakes?

You don't want a rigid history on the case of some mistake exposing the data. (Like a weak password.) Backups that you can erase work fine, but version control will create trouble.

Yeah, rotating the passwords when there is a possibility of a leak would be mandatory of course. (As it should be anyway.)

Re: Ask HN: How to store and share passwords in a company?

#269

Post by bzmrgonz »

SoftTalker wrote: post #245
afavour wrote: post #228

Earlier quoted context omitted.

It’s not really your fault, it’s us bending your free tier into something it isn’t intended to be. Maximum number of passwords shared, only logging in to one device at a time etc. It’s a really weird edge case but eye opening for me as someone who is usually in a very well resourced tech environment. Google offers a great free tier for non profits and in the ideal world we’d have a password manager that plugs into ou…

I've volunteered for and served on the boards of several small, youth-oriented nonprofits. They all had this weird idea that you can't spend any money on operational stuff. Yeah I get that you want to minimize it, and you should. But payments for necessary services should just be part of the budget. There is overhead to running these orgs and not every penny can go straight through to the kids. If you make things a P…

A strength that is often overlooked at NGO's is their people power, so don't forget to leverage that. For instance, cctv, each unit, each chief and his 4 indians, could simply use wyze to monitor their immediate environment, worst case scenario, the chief leaves in a bad way and someone else has to reprogram the wyze cams to a new chief. Same with passwords, if you don't want to pay for centralized admin, then create multiple self-sufficient micro-environments with one central IT as tier 2 for advise and rescue. Think of it as vlans, but in admin terms. This method, opens up a lot of free tiers out there for each tribe/unit to leverage, as long as IT/CENTRAL, get's informed of the master-pwd (ex. bitwarden etc.).

Re: Ask HN: How to store and share passwords in a company?

#270

Post by SkyPuncher »

lolinder wrote: post #266
crazygringo wrote: post #261

Earlier quoted context omitted.

> but at a minimum any service that wants business customers will have accounts in some form. I mean, that's just not true. Plenty of successful and widely used businesses out there provide a single account/password for their service at a client company, rather than for each human user at that client company. It's a common pattern even if you think it shouldn't be. And yes they are designed for businsses and have bus…

> And yes they are designed for businsses and have business customers. What I'm saying is that by definition these aren't designed for businesses. They might have business customers, they might even think that that's where their primary market is, but they're not designed for businesses if they use an account model that is designed for single consumer. And if they can't have been bothered to put together an account s…

I think your definition is too rigid and unrealistic.

While this example is cherry picked, it’s practical and real world.

A studio is working on a project for a client. They want to share the work with the client. Setting up individual client accounts is both impractical and unnecessary. They instead opt for a single password to protect the project. This password is stored and shared by the client.

Post reply on HN