Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Best practices for safeguarding master password in organization?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Ask HN: Best practices for safeguarding master password in organization?

#41

Post by matrss »

thinkmassive wrote: post #38
lsedgwick wrote: post #26

Earlier quoted context omitted.

Either the site really doesn't support https (odd, since it is the very page that supplies the verification hashes!) or something more scary is actually happening and it's getting universally man-in-the-middled, which feels plausible for a site that offers cryptographic tools for download.

What tools are you seeing offered for download there? Yeah it’d be better to use https since it lists some checksums, but it was last updated in 2018, and Debian packages are verified anyway.

It contains a http link to "ssss-0.5.tar.gz", which I would assume is meant to be a source code archive. That really looks suspicious.

Re: Ask HN: Best practices for safeguarding master password in organization?

#42

Post by justin_oaks »

fragmede wrote: post #17
Someone wrote: post #9

> but ultimately doesn't there have to be someone who solely controls the changing and sharing of the password, and granting privileges? Not necessarily. You can set up things so that that requires two persons ( https://en.wikipedia.org/wiki/Two-man_rule ), or any 3 out of a group of 5, etc ( https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing )

More specifically, http://point-at-infinity.org/ssss/

It's nice to have an implementation of Shamir's secret sharing. I was able to try it out by installing the package via Debian.

It's unfortunate that this site only is HTTP-only and doesn't offer SSL/TLS. For an application using cryptography, it strikes me as odd that it wouldn't be available over a secure channel.

It's also odd that there are SHA-1 hashes of the downloadable files since those hashes are also presented over an insecure channel.

Re: Ask HN: Best practices for safeguarding master password in organization?

#43

Post by redder23 »

aeries wrote: post #29
redder23 wrote: post #27

Earlier quoted context omitted.

Why would you suggest 1password on any other shitty proprietary crap. Use Bitwarden, its Open Source you can self host it inside the company if you want ... and if they every do something (shady) you do not like you can switch to a fork that will instantly pop up as soon as that happens.

Can we please keep these low-effort flames off of Hacker News? 1password is clearly offering value to somebody, as they have millions of users. Feel free to criticize it, but at least give specifics.

[flagged]

Re: Ask HN: Best practices for safeguarding master password in organization?

#44

Post by fsflover »

The Qubes OS team stores their Master Signing Key on an offline machine (running Qubes of course) and use it to sign the keys of the team members: https://www.qubes-os.org/security/verifying-signatures/#how-...

The developer signing keys are set to expire after one year, while the QMSK [Qubes Master Signing Key] and RSKs [Release Signing Keys] have no expiration date. The QMSK was generated on and is kept only on a dedicated, air-gapped “vault” machine, and the private portion will (hopefully) never leave this isolated machine.

Alternatively one could use split-gpg, but it's probably a tiny bit less secure: https://www.qubes-os.org/doc/split-gpg/.

See also: https://github.com/QubesOS/qubes-issues/issues/2818

Re: Ask HN: Best practices for safeguarding master password in organization?

#45

Post by ficklepickle »

lsedgwick wrote: post #26
fragmede wrote: post #15

Earlier quoted context omitted.

With advanced/power user AWS IAM roles, it's feasible to eliminate it for day to day uses, meaning that you can have it so only one or two people you trust actually have access to the root creds, and everyone else can go about their business. Shamir's Secret Sharing software, ssss, will let you encrypt a file and split it into pieces so that 3 of 5 people are needed to decrypt. http://point-at-infinity.org/ssss/

Either the site really doesn't support https (odd, since it is the very page that supplies the verification hashes!) or something more scary is actually happening and it's getting universally man-in-the-middled, which feels plausible for a site that offers cryptographic tools for download.

It serves the cert for 0pointer.net, which is served from the same IP. I think it is more likely to be a poorly configured personal site than something nefarious.

If you are concerned, 0pointer.net has contact info.

Re: Ask HN: Best practices for safeguarding master password in organization?

#46

Post by sebk »

lsedgwick wrote: post #21

To add on with another question, are there systems (like password managers, or others) which have "double password" as a first-class feature? For instance, a hacky way could be if personA knows passwordA only, and personB knows passwordB, and the literal password for a system is the concatenation "passwordA + passwordB" - you could get that if both people sat at the same keyboard (or did something else annoying), but…

Have a look at https://mitxela.com/projects/shamirs_password_store for an explanation of a suitable algorithm for this use case.

Re: Ask HN: Best practices for safeguarding master password in organization?

#47

Post by _trampeltier »

adbachman wrote: post #33
_trampeltier wrote: post #22

Earlier quoted context omitted.

I couldn't find it just now, but there was at least one case, where the admin did throw away the all keys when he left the company. Sometimes strange things can happen if you start having personal trouble, like the boss slept with admins wife ...

There's a thin line between by-the-books malicious compliance "throw away all the keys" and "intentionally destroyed company property". You'd sure want "please delete all our information from your personal devices" in writing. I can imagine a company whose business is impacted by intentional deletion of data by an aggrieved ex-employee could make a convincing case in a civil suit, even if criminal charges don't stick…

Killing someone is also illegal and you have to go to jail .. but it does happen still all the time. Human are human. Sometimes things just happen.

Re: Ask HN: Best practices for safeguarding master password in organization?

#48

Post by sacnoradhq »

Use secret vaulting, never a shared password manager.

For ultimate offline secrets like HSM, CA, or crypto private keys, buy new printers, print the secrets as QR codes and keep them in safety deposit boxes at 2-3 different banks.

For passwords you don't want any one exec to have, use N-person keying by splitting 1 or multiple keys into pieces such that a quorum of 2,3, etc. are needed to utilize the secret.

Re: Ask HN: Best practices for safeguarding master password in organization?

#49

Post by thinkmassive »

matrss wrote: post #41
thinkmassive wrote: post #38

Earlier quoted context omitted.

What tools are you seeing offered for download there? Yeah it’d be better to use https since it lists some checksums, but it was last updated in 2018, and Debian packages are verified anyway.

It contains a http link to "ssss-0.5.tar.gz", which I would assume is meant to be a source code archive. That really looks suspicious.

My apologies, I didn’t realize those were links.

Hopefully anyone interested for more than academic reasons does their research on the range of solutions more widely available.

Re: Ask HN: Best practices for safeguarding master password in organization?

#50

Post by matrss »

thinkmassive wrote: post #49
matrss wrote: post #41

Earlier quoted context omitted.

It contains a http link to "ssss-0.5.tar.gz", which I would assume is meant to be a source code archive. That really looks suspicious.

My apologies, I didn’t realize those were links. Hopefully anyone interested for more than academic reasons does their research on the range of solutions more widely available.

To be fair, the color is misleading. I associate red text with dead links and that is the only reason I checked what they point at.
Post reply on HN