Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage shared company passwords?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Ask HN: How do you manage shared company passwords?

#31

Post by anonymouz »

abeh wrote: post #23

I have used http://www.strongbox.io/ - it allows you to create a 'box' of passwords or other data that is securely shared with other users.

How does their claim:

"Your password never leaves your phone or computer and is not stored anywhere. Encryption occurs locally. You are the only one that can decrypt your data!"

square with

"Anywhere, anytime access. Access on the phone, web or desktop. All apps work in offline mode & auto sync when connected."

If they provide a web interface, they'll probably get access to my key at least temporarily (unless they decrypt in JavaScript and I trust them to not hijack this). GPG + Dropbox seems a little less convenient, but significantly safer since I have full control over the encryption process, especially in view of the fact that the US seems to be keen on listening in on cloud data of non-US citizens.

Re: Ask HN: How do you manage shared company passwords?

#32

Post by deanclatworthy »

shanelja wrote: post #26

We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something like this (of course, this is slightly different): (First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name) So, for instance, www.mcondalds.com would be: mc + To01n + com + ds || mcTo01ncomds This appears random to the client but…

Also the weakness here is that if two websites with weak password security are compromised (let's not forget recent history) your company password naming scheme will be completely obvious at first glance, assuming you use the same email login.

Re: Ask HN: How do you manage shared company passwords?

#33

Post by culturestate »

jiggy2011 wrote: post #25

If you are using plain FTP for something then it is safe to assume that security is not a priority anyway, so a shared .txt file with the password in should suffice.

Thank you, but by "client FTP" I mean an FTP server provided by a client for data exchange as part of their internal protocols. It's not always possible for us to bend clients' IT policies to our own desires.

Re: Ask HN: How do you manage shared company passwords?

#35

Post by onemorepassword »

We're currently using 1Password with the database on Dropbox. Which is extra convenient since it allows read-only access via Dropbox without needing the client.

The company used KeePass before, but that created a single point of failure for access and maintenance.

However, if I had to choose now I might go with LastPass (which I use privately), although I'm still somewhat uneasy about depending on an online service.

Re: Ask HN: How do you manage shared company passwords?

#37

Post by shanelja »

deanclatworthy wrote: post #32
shanelja wrote: post #26

We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something like this (of course, this is slightly different): (First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name) So, for instance, www.mcondalds.com would be: mc + To01n + com + ds || mcTo01ncomds This appears random to the client but…

Also the weakness here is that if two websites with weak password security are compromised (let's not forget recent history) your company password naming scheme will be completely obvious at first glance, assuming you use the same email login.

No, each website has a unique username for the admin system, thought these are normally just the company name.

Re: Ask HN: How do you manage shared company passwords?

#38

Post by estel »

shanelja wrote: post #29
jere wrote: post #27

Earlier quoted context omitted.

Wouldn't this mean ex-employees would know your password scheme indefinitely?

I suppose so, yes, but on the other hand, wouldn't it mean that every time an employee left, wouldn't you have to go through every single password (currently 436) and change them? In any case, once we sign off on a project, the client normally like to set up their own usernames and passwords for admin accounts, it gives them a sense of control.

If they're random passwords, they'd need ongoing access to the password database. (If there are suitable protections against the database being exported.)

Re: Ask HN: How do you manage shared company passwords?

#39

Post by jgrahamc »

shanelja wrote: post #26

We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something like this (of course, this is slightly different): (First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name) So, for instance, www.mcondalds.com would be: mc + To01n + com + ds || mcTo01ncomds This appears random to the client but…

Your scheme doesn't appear to provide any entropy at all (or at least hardly any). The only unknown part of is the To01n which if compromised causes the entire scheme to fail (assuming you accept Kerckhoffs's principle). If it's widely known in the company then it's an 'open secret'.

If the unknown part is not compromised then I have to crack 5 characters. Assuming, best case, this is taken from the entire printable ASCII set then there are 32 bits of entropy. That's very weak.

Re: Ask HN: How do you manage shared company passwords?

#40

Post by estel »

Ecio78 wrote: post #14
tallanvor wrote: post #4

There isn't a perfect solution, but LastPass Entrprise or a similar service is probably the closest you're going to get. KeePass is great, but it's a single user solution. --Even I have to be careful about forgetting to save the database after adding a new entry at work and then going home and adding something else there. You shouldn't even be entertaining the idea of a Google Docs sheet or an Excel file in Dropbox w…

We use KeePass as a multi-user solution: the kdb file is on a network share (with relevant ACLs). The only thing you have to take into account is that you dont have to leave it opened on your computer, so the typical use is: Open / Read (or Write) Password / Close it. It works in small groups (we're three guys using it, two more frequently)

We do something similar, but with relatively few users using Keepass 2, there aren't really any issues with leaving it open on multiple machines. Is there an issue besides synchronisation?
Post reply on HN