Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage shared company passwords?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 65 posts

Re: Ask HN: How do you manage shared company passwords?

#51

Post by ScottWhigham »

shanelja wrote: post #26

We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something like this (of course, this is slightly different): (First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name) So, for instance, www.mcondalds.com would be: mc + To01n + com + ds || mcTo01ncomds This appears random to the client but…

I have a hard time believing that you use this system everywhere in your company. Wouldn't any employee then be able to guess the password to any company service? I'd be able to guess the company PayPal account, the company Stripe account, the company bank account, etc. I just don't believe that a real, legitimate company that is able to have enough success to have hired employees would've done something like this across the board.

Re: Ask HN: How do you manage shared company passwords?

#53

Post by tallanvor »

estel wrote: post #49
Ecio78 wrote: post #44

Earlier quoted context omitted.

afaik the second user should open it read only, so it cant update (that's why I was saying that the user should close it after having read/written some data)

That was true for Keepass 1, but since 2 I think everyone can open it read/write? I think I'm prompted to "synchronise" when I save if another user has saved since I first opened it.

Ah, if KeePass v2 allows for synchronization, then that solves the big problem of people overwriting each other.

Although I would probably still suggest a solution that allows more granular access controls and doesn't require everyone to share the same password for logging in.

Re: Ask HN: How do you manage shared company passwords?

#56

Post by shanelja »

ScottWhigham wrote: post #51
shanelja wrote: post #26

We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something like this (of course, this is slightly different): (First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name) So, for instance, www.mcondalds.com would be: mc + To01n + com + ds || mcTo01ncomds This appears random to the client but…

I have a hard time believing that you use this system everywhere in your company. Wouldn't any employee then be able to guess the password to any company service? I'd be able to guess the company PayPal account, the company Stripe account, the company bank account, etc. I just don't believe that a real, legitimate company that is able to have enough success to have hired employees would've done something like this ac…

You misunderstand, we use these passwords for client website logins for the admin accounts prior to the client changing them, as per the PayPal account, etc, that is taken care of by the Boss, IE, I don't have a clue what they are. Most likely his Gmail password.

Re: Ask HN: How do you manage shared company passwords?

#58

Post by Cogito »

lifeisstillgood wrote: post #50
Cogito wrote: post #12

Earlier quoted context omitted.

The 'traditional' method requires gpg on the client machine. The vault was just a way of uploading text and having it encrypted on the server automatically. The user was required to download the encrypted data and then decode it themselves. You can now do more things, like password protect the data, provide access to specific users, and perform a 'server assisted' decryption, which allows you to provide the private k…

So the security is essentially as strong as the Confluence User security? As an aside, are you aware of what progress has or has not been made in GPG as part of a browser API? I am not sure if thats your area cheers

> So the security is essentially as strong as the Confluence User security?

There are two main types of security provided by the plugin, gpg key pair encryption and user access control.

The user access control is only as good as Confluence security, except that you can additionally ask for a password.

The gpg encryption is as good as your private key management. There is a new option that allows users to decrypt without installing gpg on their local machine, however they still require the private key and passphrase.

With regards to gpg as a browser api, I am not sure what progress has been made. For this application, if you use the in-browser decryption, it appears that the decryption is done server side. I'm not sure what the security implications of that would be, although I would want to be using a secured connection at the least.

Re: Ask HN: How do you manage shared company passwords?

#59

Post by abatz »

anonymouz wrote: post #31
abeh wrote: post #23

I have used http://www.strongbox.io/ - it allows you to create a 'box' of passwords or other data that is securely shared with other users.

How does their claim: "Your password never leaves your phone or computer and is not stored anywhere. Encryption occurs locally. You are the only one that can decrypt your data!" square with "Anywhere, anytime access. Access on the phone, web or desktop. All apps work in offline mode & auto sync when connected." If they provide a web interface, they'll probably get access to my key at least temporarily (unless they de…

In all cases, including the web interface, the app is client-side. When you access the web interface, a Silverlight app is actually downloaded to your browser, so decryption and encryption is always done locally. Once a box has been modified, the box is encrypted locally, saved locally, and then it is uploaded over HTTPS to cloud storage.

With no-compromise security in place, and with the incredible convenience the app affords, it is leaps and bounds better than home brewed solutions like GPG + Dropbox (which I have used for many years prior to switching to Strongbox).

I have found Strongbox so awesome, that I wanted a Terminal/command-line "Strongbox reader", so I recently wrote a Ruby gem and command-line interface for decrypting and reading Strongbox files:

https://github.com/abatko/strongboxio

Just try Strongbox, and I'm sure you'll be quickly impressed. Besides the obvious conveniences, including box sharing, it is possible to transfer ownership (e.g. you start a box, and pass its ownership on to your client). Also, there is an amazing feature planned that will bring cloud password storage to the next level.

Re: Ask HN: How do you manage shared company passwords?

#60

Post by KMag »

As far as FTP passwords, publish them in big blinking lights out in front of your office. Make absolutely sure each FTP password is isolated to a single site, and not reused for any other purpose.

As alternatives, kerberized FTP will allow you to generate keytabs and many scp setups have public key auth enabled.

Post reply on HN