Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage shared company passwords?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Ask HN: How do you manage shared company passwords?

#41

Post by qixxiq »

I recently posted https://password.ly here, and while it got a huge amount of hate for having users submit their passwords to my server, the actual concept is really useful. The command line client also never needs to send the password (unless you sync, and I'm trying to plan updates so that isn't required.)

Basically it uses bcrypt with the site name in the salt, so you get a completely unique password that can't be reversed for each site. Each employee will get access to our master password which can be changed on a semi-regular basis and then we keep a tab-completeable list of all seperate site names that were used.

Re: Ask HN: How do you manage shared company passwords?

#42

Post by shanelja »

jgrahamc wrote: post #39
shanelja wrote: post #26

We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something like this (of course, this is slightly different): (First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name) So, for instance, www.mcondalds.com would be: mc + To01n + com + ds || mcTo01ncomds This appears random to the client but…

Your scheme doesn't appear to provide any entropy at all (or at least hardly any). The only unknown part of is the To01n which if compromised causes the entire scheme to fail (assuming you accept Kerckhoffs's principle). If it's widely known in the company then it's an 'open secret'. If the unknown part is not compromised then I have to crack 5 characters. Assuming, best case, this is taken from the entire printable…

While that may be true, an attacker would not initially know the scheme, but with a list of passwords would instantly notice the To01n so I could argue that that is in fact the weakest part of this procedure, which leaves them with the 7 letters remaining:

mc ds and com - but it would not be obvious from the outset how to calculate these nor that we were even using a scheme.

So assuming the shared portion of the password is compromised I assume it would be 64 bits of entropy? (I'm not overly experienced with calculating that so I assumed you did 2 x 2 ^ numberofcharacters, whereas in this case we have 6 characters, doubling the entropy.)

While this may not be a massive amount, bare in mind these are temporary passwords and last only a week or two before we sign off on a project and the client has access.

Re: Ask HN: How do you manage shared company passwords?

#43

Post by jiggy2011 »

culturestate wrote: post #33
jiggy2011 wrote: post #25

If you are using plain FTP for something then it is safe to assume that security is not a priority anyway, so a shared .txt file with the password in should suffice.

Thank you, but by "client FTP" I mean an FTP server provided by a client for data exchange as part of their internal protocols. It's not always possible for us to bend clients' IT policies to our own desires.

If you are using FTP without wrapping it in TLS then your password is being sent over the network & internet in plaintext so how secure the password is on your machine is probably a moot point.

Re: Ask HN: How do you manage shared company passwords?

#44

Post by Ecio78 »

estel wrote: post #40
Ecio78 wrote: post #14

Earlier quoted context omitted.

We use KeePass as a multi-user solution: the kdb file is on a network share (with relevant ACLs). The only thing you have to take into account is that you dont have to leave it opened on your computer, so the typical use is: Open / Read (or Write) Password / Close it. It works in small groups (we're three guys using it, two more frequently)

We do something similar, but with relatively few users using Keepass 2, there aren't really any issues with leaving it open on multiple machines. Is there an issue besides synchronisation?

afaik the second user should open it read only, so it cant update (that's why I was saying that the user should close it after having read/written some data)

Re: Ask HN: How do you manage shared company passwords?

#46

Post by jgrahamc »

shanelja wrote: post #42
jgrahamc wrote: post #39

Earlier quoted context omitted.

Your scheme doesn't appear to provide any entropy at all (or at least hardly any). The only unknown part of is the To01n which if compromised causes the entire scheme to fail (assuming you accept Kerckhoffs's principle). If it's widely known in the company then it's an 'open secret'. If the unknown part is not compromised then I have to crack 5 characters. Assuming, best case, this is taken from the entire printable…

While that may be true, an attacker would not initially know the scheme, but with a list of passwords would instantly notice the To01n so I could argue that that is in fact the weakest part of this procedure, which leaves them with the 7 letters remaining: mc ds and com - but it would not be obvious from the outset how to calculate these nor that we were even using a scheme. So assuming the shared portion of the pass…

Ignoring the fact that I usually go by Kerckhoff's Principle and would assume that an attacker knows the scheme. Let's imagine the situation where two passwords are compromised.

1. As you say the To01n would be static and I would assume that this would be the same in both

2. If both sites are .com then I'll spot the com in both and so I'll end up assuming there are 4 characters to attack. And they appear to be lowercase.

3. Or they are not both .com and assuming I'm not smart I think there are 7 or 8 characters to attack (all lowercase).

In case #2 picking 4 characters from lowercase ASCII has an bit strength of 4.7 bits per character and so 18 bits. Very weak.

In case #3 picking 8 characters from lowercase ASCII has a bit strength of 38 bits. Still weak.

Re: Ask HN: How do you manage shared company passwords?

#47

Post by shanelja »

jgrahamc wrote: post #46
shanelja wrote: post #42

Earlier quoted context omitted.

While that may be true, an attacker would not initially know the scheme, but with a list of passwords would instantly notice the To01n so I could argue that that is in fact the weakest part of this procedure, which leaves them with the 7 letters remaining: mc ds and com - but it would not be obvious from the outset how to calculate these nor that we were even using a scheme. So assuming the shared portion of the pass…

Ignoring the fact that I usually go by Kerckhoff's Principle and would assume that an attacker knows the scheme. Let's imagine the situation where two passwords are compromised. 1. As you say the To01n would be static and I would assume that this would be the same in both 2. If both sites are .com then I'll spot the com in both and so I'll end up assuming there are 4 characters to attack. And they appear to be lowerc…

Thanks for the reply, would you be able to supply a decent link or a quick explanation of how you calculate that? I'm more than happy to admit I'm wrong when I am - the scheme is to make sure all client passwords are different, though not in any way secure against an intelligent attacker - but I am keen to learn more about this, so that as with every discussion on HN, I walk away with a little more knowledge and a little less stupidity.

Re: Ask HN: How do you manage shared company passwords?

#48

Post by jgrahamc »

shanelja wrote: post #47
jgrahamc wrote: post #46

Earlier quoted context omitted.

Ignoring the fact that I usually go by Kerckhoff's Principle and would assume that an attacker knows the scheme. Let's imagine the situation where two passwords are compromised. 1. As you say the To01n would be static and I would assume that this would be the same in both 2. If both sites are .com then I'll spot the com in both and so I'll end up assuming there are 4 characters to attack. And they appear to be lowerc…

Thanks for the reply, would you be able to supply a decent link or a quick explanation of how you calculate that? I'm more than happy to admit I'm wrong when I am - the scheme is to make sure all client passwords are different, though not in any way secure against an intelligent attacker - but I am keen to learn more about this, so that as with every discussion on HN, I walk away with a little more knowledge and a li…

http://en.wikipedia.org/wiki/Password_strength

Re: Ask HN: How do you manage shared company passwords?

#49

Post by estel »

Ecio78 wrote: post #44
estel wrote: post #40

Earlier quoted context omitted.

We do something similar, but with relatively few users using Keepass 2, there aren't really any issues with leaving it open on multiple machines. Is there an issue besides synchronisation?

afaik the second user should open it read only, so it cant update (that's why I was saying that the user should close it after having read/written some data)

That was true for Keepass 1, but since 2 I think everyone can open it read/write? I think I'm prompted to "synchronise" when I save if another user has saved since I first opened it.

Re: Ask HN: How do you manage shared company passwords?

#50

Post by lifeisstillgood »

Cogito wrote: post #12
lifeisstillgood wrote: post #9

Earlier quoted context omitted.

Thats fascinating - does it need gpg on the client machines - or (and this is a guess) if you are logged in as Fred, does the server store Fred's private Key? Actually - I am going to stop guessing - how do you arrange keys and decryption please?

The 'traditional' method requires gpg on the client machine. The vault was just a way of uploading text and having it encrypted on the server automatically. The user was required to download the encrypted data and then decode it themselves. You can now do more things, like password protect the data, provide access to specific users, and perform a 'server assisted' decryption, which allows you to provide the private k…

So the security is essentially as strong as the Confluence User security?

As an aside, are you aware of what progress has or has not been made in GPG as part of a browser API? I am not sure if thats your area

cheers

Post reply on HN