Yellow sticky note on the monitor?
Buy_m1lk.
Ask HN: How to store and share passwords in a company?
41–50 of 297 posts
Re: Ask HN: How to store and share passwords in a company?
#42Hashicorp Vault generally linked up to IDp or One Time Secret (or some service with expiring limited use links).
It’s pretty extendable and can integrate with other engineering use cases, shame about hashicorp license change though. Openbao looks great though as a replacement. These are open source so look no further if that’s what you’re looking for if you want password management, ssh auth, cert issuance, authentication and secret retrieval with k8s for example.
Re: Ask HN: How to store and share passwords in a company?
#43- Use 1Password or similar password vault to deliver account passwords on day one; the password manager also promotes good personal password management practices - only share passwords for personal accounts; those accounts you terminate when the employee separates. For shared resources, use SSO and SCIM group management via the SSO provider to add and remove accounts from groups with different roles. Rippling seems l…
We use 1Password at our company and it works extremely well.
We also use opal for dynamic access to things like AWS or our DB service where a temp user with a specific IAM role / temp db user / pass is created for that user's session. For higher level access, someone would approve the request before credentials are generated.
Re: Ask HN: How to store and share passwords in a company?
#44I'd strongly advise against 1Password, several answers here recommending it and I suspect conflating personal use with 'good enough for business', hard disagree. Your company can apply various aspects of threat modelling and more often than not several companies I've worked with find that Bitwarden self-hosted can meet a lot of requirements, this is the best solution in terms of privacy and security and controlling y…
What makes Bitwarden better than 1Password for company use?
Re: Ask HN: How to store and share passwords in a company?
#45honestly wonder if this is a 1pass ad thinly veiled as a question on the hn front page? if you have to ask, you shouldnt be doing it - hire or at least consult an IT professional
Asking on Hacker News IS consulting with IT professionals.
Re: Ask HN: How to store and share passwords in a company?
#46Just want to say that StackExchange is the place to get answers for questions like this (waiting for my downvotes). Is there a better place?
https://news.ycombinator.com/newsguidelines.html
> On-Topic: Anything that good hackers would find interesting.
I find the challenge of sharing passwords within a company extremely interesting.
Re: Ask HN: How to store and share passwords in a company?
#47- Use 1Password or similar password vault to deliver account passwords on day one; the password manager also promotes good personal password management practices - only share passwords for personal accounts; those accounts you terminate when the employee separates. For shared resources, use SSO and SCIM group management via the SSO provider to add and remove accounts from groups with different roles. Rippling seems l…
OOI do you ever use SCIM for something really granular? I have a service where people can be one of 5 roles and then have access to 1..30 named 'workspaces' - all that we'd like to control with policy on our side not vendor side
I think it's unsuitable for SCIM because I'd have to create 5*30 AD groups?
Re: Ask HN: How to store and share passwords in a company?
#48Shared passwords should always be an exception. Prefer SSO. However the exception will always exist, in which case:
Some suggest using KeePass or equivalent, but I advise against it - too easy to copy and leave with the vault and very difficult to audit.
Find a solution that audits who had access to such password. And do your audits!
Consider rotating your shared passwords frequently, especially any high privileged ones.
If your risks warrant it, check for a PAM (privileged access manager) that acts as a middlemen and fully hides the password.
I realize I am not really answering your questions, so I'll stop here. But... SSO and proper directory management!
Re: Ask HN: How to store and share passwords in a company?
#49At my previous work 1Password was replaced with Keeper. The main reason was better integration with SSO as Keeper can be unlocked with SSO itself so the user needs to remember just single password and for the rest either SSO was used directly or Keeper was used for other passwords.
Re: Ask HN: How to store and share passwords in a company?
#50Self hosted Bitwarden instance?