Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to store and share passwords in a company?

news.ycombinator.com

Post reply on HN
Print view View original

281–290 of 297 posts

Re: Ask HN: How to store and share passwords in a company?

#281

Post by teekert »

caeril wrote: post #275
teekert wrote: post #265

Earlier quoted context omitted.

I certainly do, I have not seen anything yet that makes me reconsider. They have always answered to concerns well. They pass security audits. Sure I'd prefer a Linux Proton Drive client over a BTC wallet, but nobody's perfect.

> I have not seen anything yet that makes me reconsider Proton will pwn you if Interpol smiles at them the right way. This is common knowledge.

That is indeed bs. They gave up some IP addresses in accordance with local laws.

Why are you saying this? To justify your own use of free big tech services at the cost of all your data? Proton services have been audited, Proton staff cannot access your encrypted data. Whereas we know from Snowden et al that your data in most public clouds is readily available to the world police. Make a pic of your kid's private parts for medical reasons and people have found out the difference. My pictures are encrypt before they go to Proton Drive.

If Apple starts on-device scanning to see if I'm a criminal while I sleep, I'll be on GrapheneOS several days later, but still a happy Proton user.

Re: Ask HN: How to store and share passwords in a company?

#282

Post by ale42 »

lucb1e wrote: post #65
ale42 wrote: post #62

Earlier quoted context omitted.

And (except on a specific site within their network), product recommendations are OT.

I was going to ask if it isn't the other way around, when I realized you probably mean off-topic rather than on-topic. If anyone ever runs a competition for the worst acronym ever, this nominee can probably only be topped by a three-way confusion or something that threatens lives!

Yes I realized later that OT might have two meanings, and the most probable one is not the same everywhere... but too late to edit.

Re: Ask HN: How to store and share passwords in a company?

#283

Post by caeril »

teekert wrote: post #281
caeril wrote: post #275

Earlier quoted context omitted.

> I have not seen anything yet that makes me reconsider Proton will pwn you if Interpol smiles at them the right way. This is common knowledge.

That is indeed bs. They gave up some IP addresses in accordance with local laws. Why are you saying this? To justify your own use of free big tech services at the cost of all your data? Proton services have been audited, Proton staff cannot access your encrypted data. Whereas we know from Snowden et al that your data in most public clouds is readily available to the world police. Make a pic of your kid's private part…

I'm not making a claim that FAAANG is any better. I'm just saying that when FVEY wants your data and you've opted for convenience over security, you WILL be owned. It's not so much that Proton is untrustworthy, it's that they operate a business, and if the pigs tell them to make exceptions to their policy for your account, it's game over for you. Proton doesn't have the balls that Ladar Levison did with Lavabit. They won't shut down for you, they will hand you over on a silver platter for the pigs to pick away at your flesh.

Don't use any external service hosted in a country that complies with LEO or MLAT requests from the country of your residence. Actively seek out services hosted in countries that are hostile to the country of your residence.

Host your own infra, with your own authenticated FDE, reed switches and shock sensors for instant power-down on the cabinet, tamper-resistant and tamper-evident everything. Tor Hidden Services and i2p eepsites for any and all private correspondence if you really take this seriously.

Re: Ask HN: How to store and share passwords in a company?

#284

Post by ativzzz »

trueismywork wrote: post #249
vhiremath4 wrote: post #236

It really depends on how mature your org and stacks are. This is generally how I would do it. 1-20 people - password manager (bitwarden, 1pass, etc.) 20-30+ people - SSO 50+ people - start assigning real roles to your SSO schema 1-5 services - secrets in CircleCI and password manager is good enough. 5+ instances - use a secrets manager like Vault. 10+ instances - start using a secrets manager locally as well for dev.…

Are they engineers if they appeal to emotions when evaluating risk ?

Maybe you joke but absolutely. Good security is about empathizing with the users and knowing the risk model of the organization and finding a balance of security + best possible UX.

Re: Ask HN: How to store and share passwords in a company?

#286

Post by someonehere »

Use something like 1Password and integrate with your SAML/SSO provider (Okta).

You have the ability to share a password to anyone even without an account (similar to OTS). Team vaults. Recovery. Etc..

Been using it the last few companies and it’s worth the money.

You always want to take into account who will manage this when it breaks and how often? Roll your own BW instance you’ll be in charge of it 24/7. Outsource the infrastructure to 1Pass and you really only have to manage policies and access.

Re: Ask HN: How to store and share passwords in a company?

#288

Post by gottoupvote »

corford wrote: post #233
tptacek wrote: post #102

You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…

Agree. The trio of Okta + Bitwarden + AWS Secrets Manager covers most bases and has served us well. The SSO tax is real though, especially if you're a . Shout out to the few enlightened/kind SaaS peeps that don't do this (e.g. Windmill.dev) !

Consider updating https://sso.tax/

Re: Ask HN: How to store and share passwords in a company?

#290

Post by eindex »

If you're in a one-man or couple company, then a password manager is enough, eg. 1Password, Bitwarden, or Vaultwarden.

But when your employees start to join and out, the first thing is SSO, IAM & IGA. With strong password requirements, schedule rotation, and MFA. All employees can be onboarded on day one and lost permission on the last day. Then how does an employee on day one know the init credential, you can share the init password with the employee in the onboarding email or face-to-face. The RBAC or ABAC control relies on IAM. The employee lifecycle management and approval can rely on IGA. After this, the milestone for supporting the employee's identity lifecycle is done.

Currently, You have an empty app dashboard. When you start onboarding applications, most mature 2B applications will easily integrate. Eventually, you need to onboard some applications that only support credentials login. This time you need password injection, eg. the password-based SSO on Microsoft Entra ID. Or root or breaking class accounts in the application cannot be integrated with the SSO system, You need to find a new tool, which is PAM. eg. CyberArk, or Hashicorp Boundry. Which can protect those privileged accounts.

In the end, Just do remember, never directly share credentials with your employees, except the init password for your SSO, human error always exists in the real world, people always forget to change the password after an employee or manager leaves or switches positions, and they will assume that person is a good guy, no worry for no rotation.

Post reply on HN